AI-generated bug reports spam open source projects
Open source developers are reportedly receiving an increasing volume of low-quality, AI-generated bug reports that waste maintainer time despite appearing initially legitimate. The spam includes hallucinated security vulnerabilities, lacks reproducible steps, and is often submitted without disclosure that AI tools were used.
What happened
Seth Larson, a security developer-in-residence at the Python Software Foundation, reported an uptick in 'extremely low-quality, spammy, and LLM-hallucinated security reports to open source projects.'
A detailed bug report submitted to Curl alleged buffer overflow vulnerabilities in Curl_inet_ntop and inet_ntop4 functions, but Curl maintainer Jim Fuller found the report unactionable, containing no steps to reproduce the bug.
When the report was labeled as 'AI slop,' the submitter claimed disrespect and lack of empathy, leading Curl maintainer Daniel Stenberg to state the project receives such reports regularly and at volume.
Reported impact
Open source maintainers are spending time evaluating and debunking bug reports created using AI code-generation tools, diverting effort from legitimate security work.
Small groups of unpaid contributors maintaining ubiquitous code libraries such as Python, WordPress, and Android are bearing the burden of processing spam reports.
Index analysis
LLMs hallucinate and produce wrong or partial code without understanding the underlying logic, leading to false security vulnerability claims when used for code analysis.
AI-generated reports appear initially legitimate at first glance but lack reproducible steps or concrete proof of vulnerability.
Governance controls
Curl maintainers are implementing swift actions against AI-generated spam reports going forward.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.