AI might cut false positives, but it won’t stop the slop - CyberScoop

GitHub is updating its requirements for bug bounty submissions in response to an increase in AI-assisted vulnerability reports over the past year. The code hosting platform is tightening the definition of a 'complete' report, aiming to reduce low-quality submissions before a projected flood from frontier AI models like Anthropic's Mythos and OpenAI's Daybreak.

The changes come as large language models become capable of generating detailed but often inaccurate vulnerability descriptions. GitHub has not disclosed specific metrics on the increase, but acknowledged the trend is 'significant.' The platform is also preparing for the anticipated release of advanced red-teaming models that could generate thousands of potential vulnerabilities.

GitHub's move is seen as a preemptive measure to maintain the effectiveness of its bug bounty program.