Guardian360
Start free trialBecome a partner
← All posts

Opinion

The good-faith myth: why AI is breaking vulnerability disclosure, and why it was always going to

By Jan Martijn Broekhof ·

A colleague forwarded me a support ticket last week. At first glance it looked like the real thing: a detailed, technically fluent report about a missing MTA-STS record, complete with an explanation of the risk and a tidy summary of the remediation. Extensive. Professional. The kind of report you want to take seriously.

Except it never named the domain it applied to. Not once. And the record it claimed was missing was, in our case, already configured.

That single omission tells you almost everything. The report was not written for us. It was written for everyone, sprayed at hundreds of organisations at once, phrased well enough that some percentage would read it, panic slightly, and reply. The sender does not need us to have the problem. The sender only needs enough of the recipients to believe they might.

A report that costs nothing to send

My colleague has watched a steep rise in exactly this kind of ticket lately. “Security bug bounty researcher” reports that read as legitimate and thorough, and dissolve into nothing the moment you check them against reality. Generic findings, missing scope, records that are not actually missing, all framed with the confident polish of an AI-assisted summary. Respond to one and you invite a wave of follow-ups, from the same sender and from others, each dangling another plausible-looking finding.

The strategy is not subtle once you see it. Fire as many low-effort reports as possible at as many organisations as possible, aim at the things many organisations genuinely have not configured (MTA-STS, security headers, DNS records that are nice to have but rarely urgent), and wait for a fraction to stick and pay out. It preys on a specific gap: the organisation that lacks the in-house expertise to tell a real finding from a well-dressed one.

Here is the part worth sitting with. Sending that report cost the sender essentially nothing. Reading it, triaging it, checking our own configuration, and deciding it was noise cost us real time and real attention. The economics have quietly inverted, and almost nobody has said so out loud.

We told ourselves a comfortable story

For years, the security community has described coordinated vulnerability disclosure as a relationship built on trust and good faith. A researcher finds something, discloses it responsibly, gives the vendor time to fix it, and everyone behaves like an adult. It is a nice story. It is also, I think, a story we told ourselves because the alternative was less flattering.

CVD never actually ran on good faith. It ran on cost. Producing a credible vulnerability report used to demand time, skill, and a willingness to put your name and reputation behind it. That effort was the real filter. It did not guarantee sincerity, but it correlated with it closely enough that we could treat effort as a proxy for good intent, and then quietly relabel the whole arrangement as trust because trust sounds better than “we are relying on the fact that spamming us is too much work.”

The friction was the mechanism. Remove the friction and the trust has nothing left to stand on.

Was coordinated vulnerability disclosure ever built on trust?

I do not think it was, and the clearest proof is what happens now that the friction is gone.

Look at curl. Daniel Stenberg, its founder and lead developer, ran a HackerOne bug bounty programme for years, and by most measures it worked; the project paid out more than 100,000 dollars across roughly eighty confirmed vulnerabilities over six years. Then the ratio collapsed. Until early 2025, roughly one in six reports to curl were real; by late 2025 the accurate rate had fallen to something closer to one in twenty or one in thirty. Not because the researchers got worse, but because the volume of confident, technical-sounding, ultimately empty reports exploded.

Stenberg put his finger on exactly the thing I am describing. In the old days, he said, someone actually invested a lot of time in a security report; there was a built-in friction, and now there is no effort at all, so the floodgates are open. That is the whole argument in one sentence, from someone who lived it. The friction was doing the work all along. AI did not corrupt good faith; it revealed that the good faith was underwritten by effort, and then it made effort optional.

The pressure became severe enough that curl stopped accepting HackerOne submissions and briefly redirected reporters to GitHub, with its security.txt stating the project offers no monetary compensation. When a project as well-resourced and respected as curl has to change its disclosure model to survive the noise, the “trust” framing is not just inaccurate. It is actively unhelpful, because it stops us designing for the world we are actually in.

This is not about blaming researchers

I want to be careful here, because the easy version of this argument is a cynical one, and it is wrong.

Good, skilled, honest independent researchers exist, and they are worth their weight. Stenberg himself makes the point better than I could: in September 2025 a researcher sent curl a large list of genuine issues found with AI-assisted tools, and Stenberg praised it openly as excellent work. AI in the hands of someone who understands what they are looking at is a real asset. The problem is not the tool, and it is not the researcher who files one careful, reproducible, domain-specific report.

The platforms are not the villain either. Bug bounty platforms impose structure: scope rules, reputation scores, duplicate detection, a paper trail. Those mechanisms are a modern replacement for the old friction, which is precisely why they still work. Tellingly, curl’s GitHub-only experiment did not suit the project’s needs, and by March 2026 it moved security reporting back to HackerOne, still without a bounty attached. The structure was worth keeping. The blank cheque was not.

The actor worth naming is the low-effort mass submitter: the person who points an AI tool at a list of organisations, generates plausible reports at scale, and fires them straight at whatever open channel exists, no platform, no reputation, no cost. That is what my colleague saw. It did not arrive through a filtered pipeline with a reputation score attached. It landed in our support queue.

The unguarded door we are all now told to open

Here is why this is not just an open-source problem, and why it should worry the mid-market and SME organisations I spend most of my time thinking about.

CVD is becoming standard governance, by regulation. ENISA’s own view, voiced by its head of incident and vulnerability services, is that NIS2 and the CRA are normalising coordinated vulnerability disclosure: organisations are increasingly expected to have structured processes to receive vulnerability reports, and handling them well is becoming a competitive advantage. In principle this is good. Organisations should have a front door for security reports.

But every organisation that opens that door inherits exactly curl’s problem, usually with far less expertise to defend it. A volunteer project with a dedicated security team and years of process struggled. A regional manufacturer or a mid-sized services firm, freshly told it needs a disclosure channel, has no reputation layer, no triage muscle, and no easy way to tell a framed shakedown from a genuine finding. The regulation is pushing thousands of new, open, unguarded doors into existence at precisely the moment AI has made it free to flood them. That is the pincer, and the organisations least equipped to handle it are walking straight into it.

So what do we replace the myth with?

I do not have a tidy ten-point plan, and I am suspicious of anyone who claims to. This is bigger than one company’s intake queue, and I would rather think about it in the open than pretend it is solved.

What I am fairly sure of is this: the old cost filter is gone, and it is not coming back. So the honest move is to stop calling CVD a matter of trust and start designing for a world where trust cannot be assumed at the door. That might mean re-introducing deliberate cost or friction on the sender’s side. It might mean reputation and identity layers for open channels, not just platform-hosted ones. It might mean shared triage capacity for smaller organisations that cannot build it alone. I genuinely do not know which of these will prove workable.

So I will end with the questions rather than the answers. If effort was the real filter and effort is now free, what do we put in its place that does not also shut out the honest first-time researcher? And how do we give the smallest organisations, the ones now legally expected to open a disclosure channel, a way to survive the flood that even curl could barely handle?

I would like to hear how you are thinking about this. Not rhetorically. I mean it.

Sources