Huawei tightens rules for ai-generated security vulnerability reports

Huawei has updated its security reward program to address the rise in AI-generated vulnerability reports. The company announced that it will now require manual analysis and verification before accepting reports submitted via AI tools. This follows a surge in submissions this year, many of which included PoC code but were found to be false positives due to AI 'hallucinations'. The policy prohibits the submission of unverified reports, including those generated entirely by AI without human validation. Repeat offenders may face account restrictions or bans. Additionally, the program now excludes submissions related to Huawei's development tools, such as DevEco, unless the vulnerability affects the company's devices or its supply chain. Huawei emphasized the importance of maintaining a respectful and professional community, warning against malicious behavior such as harassment or false accusations. The updated rules aim to ensure that only genuine vulnerabilities are rewarded, while protecting the integrity of the security ecosystem.