One reason AI companies are so eager to report FOSS vulnerabilities is that doing so creates the perception of need. Doesn't matter if they're mostly low-risk or low-priority. Doesn't matter that they were mostly discovered by actual cybersecurity researchers. The perception of need is the point. Volume serves that aim. Dropping 50 reports on a project makes people to think, "Wow, we're cooked without AI." That many reports at once overwhelms the maintainers? Guess they need AI to keep up.
3 Boosts
1 Like
@lrhodes it's the argument that some people are using to try to force to allow LLM reports in projects with a strict no-ai policy. Some people were telling me yesterday that I'm basically killing people for ignoring LLM security reports in libxml2