OpenAI warns that AI-generated bug reports are overwhelming developers

The flood of AI-generated noise

Open-source maintainers are currently facing a significant hurdle in securing the software they manage. As AI tools become more capable of scanning code, they are producing a massive volume of vulnerability reports that many human developers cannot keep up with. This influx of automated data is often referred to as "AI slop" in the security space.

Because the sheer number of submissions exceeds the capacity of human teams, some maintainers have begun to stop accepting any new reports at all. This creates a bottleneck where legitimate security flaws might be ignored because they are buried under hundreds of automated messages. The problem is not just the quantity of reports, but the difficulty of filtering them for actual significance.

Michael Aiello, OpenAI’s cyber executive in residence, highlighted this issue during a recent session in Washington, D.C. He noted that maintainers are often forced to sift through hundreds of AI-submitted vulnerabilities to determine if they are actually critical. This manual triage process is becoming unsustainable for the volunteers and small teams who keep the internet's infrastructure running.

Quality over automated quantity

The core of the problem lies in the lack of clarity and quality in many AI-generated disclosures. While many of these reports may identify real bugs of some degree, they often fail to explain the security implications clearly. Maintainers must decide if a bug is worth the time required to fix it, which is difficult when the report is poorly structured or lacks context.

Aiello contrasted this issue with OpenAI’s own Patch the Planet program, which takes a different approach to security. Instead of simply sending messages into GitHub and hoping for a response, the company partners with research organizations to identify flaws. This partnership ensures that the work done is high-quality and that there is a dedicated path toward a resolution.

The company's website shows that this collaborative model has been productive for the community. To date, 661 patches have been developed and tested through the program, with 458 of those being accepted by maintainers for inclusion in the projects they oversee. This suggests that a structured, human-led approach is more effective than a purely automated one.

The new rules for researchers

For those who do create vulnerability disclosures, OpenAI is offering specific advice on how to be successful in the current environment. Researchers are being told to move away from high-volume, low-effort submissions. Instead, they should focus on creating reports that are high-quality and easy for a single person to read and understand.

The goal is to make the finding "consumable" so that a maintainer does not have to spend hours deciphering the technical details. Aiello emphasized that the burden of coordination is shifting onto the person who finds the bug. Researchers are now expected to allocate their own resources to manage the disclosure process from start to finish.

This means that finding a bug is only the first step of a much larger project. A researcher must now be prepared to act as a coordinator, ensuring that the information reaches the right people at the right time. This shift requires more effort from the security community but is necessary to ensure that critical flaws actually get fixed.

Coordinating the ecosystem

A primary example of this new coordination model can be seen in OpenAI's recent work on PHP vulnerabilities. In that instance, a partner research organization discovered a flaw, and OpenAI worked directly with the PHP Foundation to validate it. They didn't just report it and walk away; they stayed involved to develop a fix and coordinate its release.

This process involved working with a broad group of organizations, including the operators who actually issue the patches. It required extending the work beyond a simple technical review to include logistical coordination across the entire ecosystem. This ensures that once a fix is ready, it can be deployed quickly and safely to all users.

Aiello admitted that this level of coordination is not always easy to achieve. He noted that the process did not go perfectly and that the team is still learning how to navigate these complexities. However, he maintains that this collaborative approach is the only way to manage the security needs of the modern software landscape.