<![CDATA[The AI slop security reporting is basically extinct.]]>The AI slop security reporting is basically extinct. It almost does not happen anymore. At all.

]]>https://board.circlewithadot.net/topic/af010520-8e50-442e-9787-d8678e22b157/the-ai-slop-security-reporting-is-basically-extinct.RSS for NodeThu, 16 Apr 2026 22:57:51 GMTWed, 15 Apr 2026 06:44:23 GMT60<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 15:43:31 GMT]]>@bagder Seems like all you need to do is take away the incentive to get rid of the low effort reports.

Sad they had to ruin it for real reporters now as they don’t get their (deserved) bounty anymore in exchange for the good work they’re doing.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Stephanie/statuses/116409487274410762https://board.circlewithadot.net/post/https://mastodon.social/users/Stephanie/statuses/116409487274410762Wed, 15 Apr 2026 15:43:31 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 14:14:38 GMT]]>@bagder Unfortunately that hasn't made it to Flask yet, we still get a bunch of AI slop. About 50 reports so far this year, none helpful. Typically we get < 10 per year, some helpful.

]]>https://board.circlewithadot.net/post/https://mas.to/users/davidism/statuses/116409137785918206https://board.circlewithadot.net/post/https://mas.to/users/davidism/statuses/116409137785918206Wed, 15 Apr 2026 14:14:38 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 13:28:59 GMT]]>@mjd@mathstodon.xyz @pozorvlak@mathstodon.xyz I mean, it’s terrible for the environment, has loads of ethical and moral concerns, and the companies are completely unsustainable. It’s pretty easy to hate
]]>https://board.circlewithadot.net/post/https://snac.benbuhse.com/ben/p/1776259739.343984https://board.circlewithadot.net/post/https://snac.benbuhse.com/ben/p/1776259739.343984Wed, 15 Apr 2026 13:28:59 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 12:37:32 GMT]]>@bagder I wonder how much of that is because you eliminated the bounty

]]>https://board.circlewithadot.net/post/https://social.treehouse.systems/users/nicolas17/statuses/116408755961709456https://board.circlewithadot.net/post/https://social.treehouse.systems/users/nicolas17/statuses/116408755961709456Wed, 15 Apr 2026 12:37:32 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 11:09:58 GMT]]>@utopiah @bagder there's no irony at all, it's at minimum a marketing strategy.

]]>https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116408411652201220https://board.circlewithadot.net/post/https://en.osm.town/users/mdione/statuses/116408411652201220Wed, 15 Apr 2026 11:09:58 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 10:34:30 GMT]]>@bagder you're lucky. I got 30+ yesterday. 1 was kind of credible. The others were effectively documented behaviors of projects.
There's still little to no consequences for wasting time - I've been thinking about the "name and shame" approach you have, maybe that helps change the behavior?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/miketheman/statuses/116408272167750043https://board.circlewithadot.net/post/https://hachyderm.io/users/miketheman/statuses/116408272167750043Wed, 15 Apr 2026 10:34:30 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 10:23:44 GMT]]>
CC: @pozorvlak@mathstodon.xyz
]]>https://board.circlewithadot.net/post/https://hj.9fs.net/ori/p/1776248624.925397https://board.circlewithadot.net/post/https://hj.9fs.net/ori/p/1776248624.925397Wed, 15 Apr 2026 10:23:44 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 10:11:58 GMT]]>@mjd ah, good point. Reliably bad reports waste a small amount of time, but more than zero. The worst case is reports that are only sometimes good, because then you have to read them all carefully.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116408183607751925https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116408183607751925Wed, 15 Apr 2026 10:11:58 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 09:56:56 GMT]]>@pozorvlak If that were the reason, wouldn't they want the reports to be as good as possible, and be glad if the reports were all worth reading? But this person says they are disappointed!

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408124472039512https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408124472039512Wed, 15 Apr 2026 09:56:56 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 09:53:44 GMT]]>@mjd I think so. But also, if all AI-generated bug reports are useless, you can stop reading as soon as you've decided a bug report came from an AI.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116408111857829499https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116408111857829499Wed, 15 Apr 2026 09:53:44 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 09:50:05 GMT]]>@bagder sure, ironically enough there is no "I" in AI.

]]>https://board.circlewithadot.net/post/https://mastodon.pirateparty.be/users/utopiah/statuses/116408097541889465https://board.circlewithadot.net/post/https://mastodon.pirateparty.be/users/utopiah/statuses/116408097541889465Wed, 15 Apr 2026 09:50:05 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 09:47:03 GMT]]>@pozorvlak Now I think a more reasonable interpretation is: they are concerned about copyright violations, environmental damage, etc., and are dismayed that people like me use AI anyway. The fact of its getting better doesn't fix the other problems, and just means that there are fewer arguments against using it.

(“This is terrible” vs. “This is terrible, maybe when people realise that it doesn't work, they will stop.”)

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408085636232775https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408085636232775Wed, 15 Apr 2026 09:47:03 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 09:39:09 GMT]]>@pozorvlak To me, the most interesting part of that thread was this post.

This person considers AI their enemy. But not because it is wasting Stenberg's time. They wanted it to continue to waste Stenberg's time, so that they could continue to hate it more.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408054560179251https://board.circlewithadot.net/post/https://mathstodon.xyz/users/mjd/statuses/116408054560179251Wed, 15 Apr 2026 09:39:09 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 08:30:48 GMT]]>@bagder Do reporters share the tools used, or are there strong tool indicators in the reports?

Curious about which tool(s) are most successful, at least for cURL research.

I imagine in most cases reporters don't mention the tools used (especially if custom), which is unfortunate.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/AlesandroOrtiz/statuses/116407785784321316https://board.circlewithadot.net/post/https://infosec.exchange/users/AlesandroOrtiz/statuses/116407785784321316Wed, 15 Apr 2026 08:30:48 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:42:56 GMT]]>@bagder Can't wait for your next graph 🤓

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/louisbotha/statuses/116407597538706934https://board.circlewithadot.net/post/https://mastodon.social/users/louisbotha/statuses/116407597538706934Wed, 15 Apr 2026 07:42:56 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:20:25 GMT]]>@bagder I see
- good ones using AI as part of a rigorous process with replication
- mediocre where someone asked an AI "Find me a CVE", submits the report without review or replication, and yet still expects credit

If "have write access to the filesystem" is a prerequisite to an exploit: it's not an exploit. You already have total ownership of the server

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116407509021332187https://board.circlewithadot.net/post/https://hachyderm.io/users/stevel/statuses/116407509021332187Wed, 15 Apr 2026 07:20:25 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:19:27 GMT]]>@Varpie @bagder 90% of the time it works every time. It probably improved dramatically, but still slop lingers?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/edmcbane/statuses/116407505234700900https://board.circlewithadot.net/post/https://hachyderm.io/users/edmcbane/statuses/116407505234700900Wed, 15 Apr 2026 07:19:27 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:18:55 GMT]]>@bagder Well, I guess you could quickly convince them otherwise with your "reports/ai-slop ratio" graph.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/LangerJan/statuses/116407503114526909https://board.circlewithadot.net/post/https://chaos.social/users/LangerJan/statuses/116407503114526909Wed, 15 Apr 2026 07:18:55 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:06:38 GMT]]>@utopiah probably, but also because the AIs can't really tell

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116407454840516903https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116407454840516903Wed, 15 Apr 2026 07:06:38 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:05:57 GMT]]>@bagder "they tend to overstress the vulnerability angle." which I imagine is simply because that's what the prompt suggested.

]]>https://board.circlewithadot.net/post/https://mastodon.pirateparty.be/users/utopiah/statuses/116407452130386833https://board.circlewithadot.net/post/https://mastodon.pirateparty.be/users/utopiah/statuses/116407452130386833Wed, 15 Apr 2026 07:05:57 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:05:32 GMT]]>@bagder yeah. Sorry. More like summary of the situation.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/grayrattus/statuses/116407450494208078https://board.circlewithadot.net/post/https://mastodon.social/users/grayrattus/statuses/116407450494208078Wed, 15 Apr 2026 07:05:32 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:02:36 GMT]]>@j_s_j @bagder @annika month.

Link Preview Image
Claude Mythos Preview \ red.anthropic.com

favicon

(red.anthropic.com)

Here you can read more.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/grayrattus/statuses/116407438976554636https://board.circlewithadot.net/post/https://mastodon.social/users/grayrattus/statuses/116407438976554636Wed, 15 Apr 2026 07:02:36 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:02:27 GMT]]>@bagder I get this with fwupd too. Everything that's AI found is reported as a CVSS 10.0 CRITICAL vulnerability, and then you find out it's assuming the attacker has write access on /etc or something dumb like that.

At that point it's just a regular old typo bugfix like all the other thousands of unimportant commits.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/hughsie/statuses/116407438393099211https://board.circlewithadot.net/post/https://mastodon.social/users/hughsie/statuses/116407438393099211Wed, 15 Apr 2026 07:02:27 GMT<![CDATA[Reply to The AI slop security reporting is basically extinct. on Wed, 15 Apr 2026 07:02:03 GMT]]>@grayrattus it was never my opinion as much as my summary of the situation... and the situation has changed quite drastically

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116407436827637430https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116407436827637430Wed, 15 Apr 2026 07:02:03 GMT