—
They will accept no LLM-generated content, nothing paraphrased from an LLM, and nothing edited, brainstormed, or debugged by an LLM. In short: Keep AI out of it.
On the JetBrains podcast, Zig President Andrew Kelley called AI-assisted contributions "invariably garbage."
—

So perhaps it’s time to tell Donny about the actual policy…

Mythos finds a curl vulnerability

yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue reading Mythos finds a curl vulnerability →

daniel.haxx.se (daniel.haxx.se)

Vulnerability submission != vulnerability research.
If they would require a human in the loop before submitting vulns, that would make sense. To ban usage of AI for vulnerability research is just plain stupid. To disallow any method to find vulnerabilities is security by obscurity and should be treated as such.

Also they're not banning the submission of reports on issues that a human has thought through and written a PoC by hand, even if the actual detection of the issue was found by some AI tool.

What's banned is offloading the whole work of "detection / PoC / writing report / submission" to AI. We want whoever did the submission also have thorough understanding of what's going on; we want to be able to inquire the thought process. You can't introspect an LLM.

Yes?!

Banning LLM generated "vulnerability" ""research"" is the proper proactive move. They've taken the lesson from cURL which was drowning in LLM generated vuln reports, of which only a tiny fraction was actually valid; the rest was fabricated noise.

If the signal-to-noise ratio gets degraded by some "tool", than this tool does more ham than good, as it will obscure legit reports.

The fabricated reports take away time from looking at the legit stuff.

OP said that. Banning any kind of vulnerability research is stupid. If you allow fuzzing why not allow AI based?

About that… ask the cURL developers how well that work(ed) for them. TL;DR: they were drowning in LLM generated vulnerability reports, of which only a tiny fraction were actually valid. Any tool that dramatically degrades the signal-to-noise ratio does more harm than good.

Where the heck did you read *that*?

also that change was before bun got "rewritten" in rust

working-group-ai-policy - GCC Wiki

(gcc.gnu.org)

LLVM allows slop, which disappointed me, even if they include language which suggests that the contributor should be accountable for the code:

LLVM AI Tool Use Policy — LLVM 23.0.0git documentation

(llvm.org)

I wonder how the complete lack of clarity around slop contributions is acceptable to the projects.

Both "what does it mean for a (social?) problem to be lisp-sized" and "what did you want to communicate with that post"?

I'm not joking. That's literal the thought process.

Perhaps Anthropic tried to purchase Zig, and was told to pound sand?