OpenAI advises on improving ai-generated vulnerability reports

OpenAI's cyber executive in residence, Michael Aiello, highlighted the challenges faced by open-source maintainers due to the overwhelming volume of AI-generated vulnerability reports. During a Q&A session at the DataTribe Challenge in Washington, D.C., Aiello explained that many maintainers have stopped accepting AI-based submissions due to the high workload and concerns about report quality. He contrasted this with OpenAI's Patch the Planet program, which partners with security research organizations to identify and resolve vulnerabilities. According to OpenAI's website, 661 patches have been developed, with 458 accepted by maintainers. Aiello emphasized the need for higher-quality reports, clear communication, and coordinated disclosure efforts. He cited OpenAI's recent work on PHP vulnerabilities as an example of successful collaboration with the PHP Foundation to validate, fix, and release patches. Aiello acknowledged the complexity of the process, noting that while it did not go perfectly, the team is learning as they progress.