AI might cut false positives, but it won’t stop the slop - CyberScoop

GitHub, bless their cotton socks, has noticed that AI-assisted bug reports are a bit, well, shit. They're tightening the definition of a 'complete' vulnerability report after a significant increase in low-quality submissions over the past year. Because nothing says 'we've got this under control' like adding more paperwork when the bots are about to drown you in garbage.

Enter Anthropic's Mythos and OpenAI's Daybreak — frontier models that will soon be churning out vulnerability reports at machine gun pace. GitHub's response? 'Let's define 'complete' more carefully.' This is like trying to fix a burst dam with post-it notes. The slop is coming, and no amount of form validation will turn AI-generated noise into genuine security findings. The signal-to-noise ratio is about to approximate a black hole's density.

Mark my words: in six months, bug bounty platforms will be staffed entirely by AI triaging AI reports, while actual humans stare at screens full of 'critical vulnerability: the /login page exists.' We'll have achieved a perfect pyramid of bullshit, and the security community will look back on these quaint days when a 'complete' report meant you could actually understand it. Cheers, GitHub — enjoy your Sisyphean climb.