AI slop security reports submitted to curl

It's pretty clear that in like half of these the "researcher" is just copy pasting the followup questions back into whatever LLM they used originally. What a colossal waste of everyone's time.

I think the only saving grace right this second is that the hallucinations are obvious and text generation is just awkward enough in overly-eager phrasing to recognize. But if you're seeing it for the first time, it can be surprisingly convincing.

As time goes on they are getting faster at closing such reports. However they started off with an assumption of honesty and only after peing burned repeatedly given up.

this is bad for the honest person who can't describe a real issue well though.

Honestly? Might be wiser block submissions from certain parts of the world that are known for spamming things like that

Or have an infosec captcha, but that's harder to come by

The hostility is not geared towards AI, they are just dumb tools, but sloppy and stupid reporters. AI is enabling those stupid reporters. The linked report basically says in typical AI blathering (paraphrase) "you use strcpy(), strcpy() is known to cause buffer overflows if not bounds checked, thus you have buffer overflow bugs"

Obviously, the logic doesn't hold. Anyway, asked to provide a specific line in a specific module where strcpy() is not bounds checked, the response is "probably in curl.c near a call to strcpy()." That moved from sloppy to stupid pretty quickly, didn't it?

And there are dozens if not hundreds of these kinds of reports. Hostility towards the reporters (whether AI or not) is justified.

I clicked on this report at random: https://hackerone.com/reports/2905552

This isn’t fuzzing, this is a totally garbage report that I’d have chewed out any security “researcher” reporting this to me.

Given how it was the first link I clicked I feel safe in saying the probability is the rest are just as bad.

"Fuzzing with AI", hilarious. Why do you think inexperienced clout chasers waited for LLMs before they started "fuzzing"? Why not use existing (real) fuzzing tools?

Because they have no idea what they're doing and for some reason they think they can use LLMs to cosplay as security researchers.

Could you maybe focus more on fuzzing the software, and less on fuzzing maintainers? You seem to applaud people submitting unverified reports in mass, for material and reputational gain, harming maintainers' ability to react to valid reports. Why?

I don’t think you took a look at the different reports :)

All are wrong, with hallucinations, and reviewers clearly loses their time with that kind of things.

AI is here to accelerate people’s job(s). Not losing their mind and time.

Please read the news before responding. An AI can do that, why don’t you do that too…?

>By all means, use AI to learn things and to figure out potential problems, but when you just blindly assume that a silly tool is automatically right just because it sounds plausible, then you're doing us all (the curl project, the world, the open source community) a huge disservice. You should have studied the claim and verified it before you reported it.

https://hackerone.com/reports/2887487

Given the limited resources available to many open source projects and the volume of fraudulent reports, they function similar to a DDOS attack.

Check out the actual reports. This is not "fuzzing with AI", it's semantically invalid reports (or outright fluff text masquerading as security mansplaining) showing absence of understanding of what is being reported.

Hostility is towards people using AI to generate garbage report spam at scale, which require time investigate, each one individually.