Before you file that AI bug report, OpenAI has some advice

Skip to main content Get our latest cybersecurity news first on Google. Click here! Open-source maintainers are so overwhelmed by AI-generated security reports that some have stopped accepting them.

OpenAI’s Daybreak lead says the fix is higher-quality findings and far more coordination. Listen to this article 0:00 Learn more. The OpenAI logo is displayed on a smartphone screen placed on a reflective surface onto which the Daybreak visual is projected, in Creteil, France, on May 12, 2026.

Daybreak is an AI-powered cybersecurity service designed to detect, analyze, and remediate software vulnerabilities more quickly. (Photo by Samuel Boivin/NurPhoto via Getty Images) Even OpenAI is admitting there is a lot of AI slop in the security space. An executive for the frontier AI company said Tuesday that AI -generated vulnerability reports are overwhelming open-source maintainers, leading some to stop accepting submissions as the workload exceeds their capacity to review them.

Michael Aiello, OpenAI’s cyber executive in residence, described the problem during a question-and-answer session Tuesday at the DataTribe Challenge in Washington, D.C., when he was asked how he viewed OpenAI ’s Patch the Planet program versus open-source maintainers banning AI-based submissions because of concerns about quality and clarity.

“It’s an ecosystem problem where that [maintainer] is just not going to respond to hundreds and hundreds of AI-submitted vulnerabilities,” Aiello said. He contrasted the volume against his company’s own program, which partners with security research organizations to identify vulnerabilities, develop fixes and help bring them into the affected projects.

According to the company’s website , 661 patches have been developed and tested, with 458 of them accepted by maintainers for inclusion in the projects they oversee. However, Aiello said those involved with Daybreak often coordinate with maintainers, as opposed to just sending a message into GitHub and hoping for the best.

He further described the broader burden on maintainers, who are often tasked with running through hundreds of AI-generated reports to determine validity, the security implications and evaluate the proposed fix. “In most cases, they’re likely real bugs of some degree,” he said. “It’s, ‘Are they critical bugs?’ And are they bugs worth the time of the maintainers?...The result is they’ve just stopped taking” submissions.

Aiello further laid out advice for those that do create vulnerability disclosures for open-source maintainers, including more work in establishing the quality of the finding, writing an understandable report and allocating resources to coordinate disclosure once a report is filed.

“Make sure they’re really high quality, make sure it’s consumable and readable by a single person, and then spend your own resources coordinating vulnerability disclosure,” he said. “You need to now coordinate the vulnerability disclosure across the whole ecosystem, which is itself another project.” Aiello used OpenAI’s work on the recent PHP vulnerabilities as an example of that coordination.

He said a partner research organization discovered the flaw, and OpenAI worked with the PHP Foundation to validate it, develop a fix and coordinate its release. “You have to work with response partners, and you have to work with the operators to actually issue the patch,” he said.

The process involved coordinating with a broad group of organizations, extending the work from technical review through patch release. Aiello acknowledged difficulties in carrying out the entire process. “Now, did it go perfectly?

No,” he said. “We’re learning as we do this over time.” More Scoops WASHINGTON, DC – SEPTEMBER 29: (L-R) U.S. Director of National Intelligence Jay Clayton, CEO of Meta Platforms Mark Zuckerberg, Co-Founder at Anthropic Tom Brown, U.S.

President Donald Trump and David O. Sacks hold a press briefing with AI executives following a meeting on artificial intelligence, outside the West Wing of the White House on September 29, 2026 in Washington, DC. The meeting comes as some have called for a slowdown in AI development amid rising safety concerns. (Photo by Kevin Dietsch/Getty Images) Senators press Trump admin to rally federal government around AI safety, security The letter argues federal agencies should more rigorously test AI models for security threats and sandbox evasion, set new safety standards and lean into defensive AI.

Your AI agent is only as safe as the packages it downloads Aerial view of water treatment factory at city wastewater cleaning facility Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software Latest Podcasts Government Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion CISA publishes strategy with eye on the next four years Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers DOJ escalates fight for election supremacy with California raids Technology Senators say targeted ads are a security risk.

Ad groups say the critics are off base. eMudhra kills its certificate business after researchers cracked its private keys in under a second Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic DHS to ban DeepSeek from federal civilian agencies Threats Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison Authorities extradite Chinese national for alleged $37M investment scam Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group PHP releases emergency fixes for 2 critical vulnerabilities Policy Federal agencies recommend cyber controls, independent testing for frontier AI systems The next election influence campaign will target your AI chatbot FTC says ‘sextortion’ protection companies deceived customers about services Major rules for federal contractors handling sensitive data are nearing the finish line