AI Is Writing Your Bug Reports. Can You Tell?
summary
Three real case studies show AI is inflating intake volume and credibility: a report with a hallucinated CVE and self-contradictory auth claims; a genuine privilege escalation that was AI-packaged to overstate blast radius; and a reproducible API auth bypass that is low polish, high signal. Triage teams see a 224% spike in submissions at one org, curl closed its bounty, and the recommended process is concrete: require versions and PoC, ask domain-specific follow-ups, separate confirmed facts from claimed impact, and score evidence not fluency.
AI-written summary · about
chapters (8)
- 0:00AI-generated bug reports
- 3:13Impact on triage
- 6:43Contradictory AI report
- 10:57Human-found vulnerability with AI
- 14:43High-signal human report
- 19:09Handling AI reports
- 20:57PAUSE mnemonic
- 22:38Q&A
related talks
57mAI Applications Security Puzzle
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
31mAI for Web3 Security
43mWho to blame? The AI, The Programmer, or The Prompt?
28mAll Your AI are Belong to Us
56mAttacking AI
29mIdentifying and Assigning AI Model Vulnerabilities
14mAI for Web3 Security: Real-World Use Cases — Dr. Stefan Beyer