"AI is a valuable tool for finding vulnerabilities, and I'm not discounting that. But seven months in, the evidence still doesn't match the launch narrative. The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile."
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
@jwildeboer Free Software and Opensource projects should just move over to accept AI generated vulnerability reports only when it comes with:
1. a reproducer
2. a exploit
3. a *acceptable* fix
Where 'acceptable' is subject to the projects policy. It may include no AI rules. It probably should include 'Does not put extra burden on us to sort out your slop'.