OpenAI Admits AI-Generated Bug Reports Are Swamping Open-Source Maintainers

Even OpenAI is acknowledging that low-quality AI-generated security reports are becoming a problem. Speaking at the DataTribe Challenge in Washington, D.C., Michael Aiello, the company's cyber executive in residence, said open-source maintainers are being overwhelmed by AI-submitted vulnerability reports. Some have stopped accepting submissions because the workload exceeds what they can review.

Aiello called it an ecosystem problem, noting that a maintainer is unlikely to respond to hundreds of AI-submitted reports. He said many of the reported issues are probably real bugs of some degree. The harder questions are whether they are critical and whether they are worth a maintainer's limited time. Maintainers must check each report's validity, assess its security implications and evaluate the proposed fix.

He contrasted this with OpenAI's own approach, which partners with security research organisations to find vulnerabilities, develop fixes and help bring them into affected projects. According to the company's website, 661 patches have been developed and tested, and 458 have been accepted by maintainers. Aiello said people involved coordinate with maintainers directly, rather than simply posting a message on GitHub and hoping for the best.