You have 1 article left to read this month before you need to register a free LeadDev.com account.
Estimated reading time: 3 minutes
Key takeaways:
- AI now floods maintainers with real bugs, not fake ones.
- Finding is fast, fixing is slow. Plan for the triage load before you roll out AI scanners.
- Verify before you report: check AI findings by hand and write them up in plain language.
Google became so overwhelmed by reports of problems with its software that it stopped accepting some bug reports. The company reckons these aren’t all well-meaning individuals filing tickets. A good proportion of them are AI.
The company announced it was pausing product vulnerability submissions to its open-source bug bounty program because of a “significant rise” in automated reports. The swarming of reports weren’t even useful to Google, the company claimed – the vast majority of them were invalid.
Your inbox, upgraded.
Receive weekly engineering insights to level up your leadership approach.
It’s the second time this year the tech giant has had to take action to limit the impact of AI reporting overwhelming its systems. Back in March, it tightened reporting rules after a “massive surge” of AI-generated reports, many of which were entirely hallucinated vulnerabilities.
If a company the size of Google is struggling with this, the problem ought to ring alarm bells for engineering managers across the sector.
AI has supercharged the ability to uncover potential vulnerabilities and flag problems in code. Each issue – legitimate or not – that’s surfaced needs to be verified, assessed and fixed, which can often take longer than pointing out holes.
Fantasy into reality
Until relatively recently, the use of AI in exploiting bug bounty programs was that the reports being filed were bogus. Now there’s an uncomfortable shift happening: AI is finding legitimate issues that need to be acted on
“Bad or fake reports are problems of the past. We basically don’t get them anymore. Our current challenge is high-volume, high-quality reports and how to deal with real findings,” says Daniel Stenberg, creator and lead developer of curl, the ubiquitous open-source data transfer tool.
Stenberg acknowledges that’s “a better problem” than what has gone before, “but still a challenge and a lot of work.”
Stenberg knows this first-hand. In May, he reported that curl was receiving security reports at four to five times its 2024 rate, with more than one arriving every day. The scale of the reporting became so overwhelming that he and other maintainers on the project took a month off from accepting new reports over the summer to give some breathing room.
More like this
Security fixes take time
“The modern imbalance is now that it is easy to generate lots of good findings but it is still time- and effort-consuming to assess, analyze, and fix the problems in those findings,” Stenberg says.
That’s a problem managers introducing AI-powered security tools need to anticipate. Uncovering issues is ultimately good because it plugs vulnerabilities, but it also demands more of developers’ time. Tech that can turn up dozens of problems in minutes can create a days-long queue for engineers to investigate.
One solution to that is not to shun AI security tools but to use them to improve their own code, something Stenberg is in favor of. However, there’s a limit to how much work they can take off humans’ hands.
“Everyone doing software these days needs to up their game and start using tools like this themselves so that code quality improves,” he explains. “Still, short term it remains an imbalance and managers should be aware to not overload the team with these findings.”
New York • September 8 & 9, 2027
Loved LDX3 New York? Pre-sale tickets for 2027 are now available.
Stenberg reckons AI-powered scanning systems should be able to establish whether or not a suspected vulnerability is genuine, before passing the task of sorting it out over to developers.
He also hopes that people using AI to identify issues in future might hand-check their claims and communicate their findings in plain, human-written language rather than dumping verbose AI output on maintainers.
However, while AI automates the process of finding security vulnerabilities, Stenberg reckons there’s one thing it shouldn’t replace. “Use whatever tools you like, but communicate as a human.”
