OpenAI executive warns AI bug reports are overwhelming open-source maintainers

AI can help find software weaknesses, but those findings are overwhelming some of the people responsible for fixing them. OpenAI cyber executive in residence Michael Aiello warned on October 27 that some open-source maintainers have stopped accepting submissions—and urged researchers to take responsibility for verification, readable reports and coordinating fixes.

Speaking during a question-and-answer session at the DataTribe Challenge in Washington, D.C., Aiello described a capacity problem, CyberScoop reported. Maintainers must review hundreds of AI-generated reports, establish whether the findings are valid, assess their security implications and evaluate proposed fixes. That work can exceed the time they have available.

His warning was not simply that AI produces false alarms. In most cases, he said, the reports probably identify real bugs to some degree. The harder questions are whether those bugs are critical and whether investigating them is worth a maintainer’s attention. A technically valid finding does not settle those questions.

The reporter’s work does not end at submission

Aiello contrasted that flood of submissions with OpenAI’s Daybreak work, which often involves direct coordination with maintainers rather than posting a finding on GitHub and waiting. The company works with security research organizations to identify weaknesses, develop patches and help get those fixes into the affected projects.

His advice to researchers covered three responsibilities, including work after a report is filed:

• Validate the finding. Put more effort into establishing its quality before passing the investigation to a maintainer.
• Make the report understandable. Aiello said it should be readable and usable by a single person, not merely a submission containing technical output.
• Resource the disclosure process. Researchers should spend their own resources coordinating with the affected ecosystem, rather than treating delivery of the report as the end of the job.

PHP shows how far coordination can reach

Aiello pointed to the recent response to vulnerabilities in PHP, a programming language used for websites and web applications. He said a partner research organization found a flaw and OpenAI worked with the PHP Foundation to validate it, develop a fix and coordinate its release.

OpenAI’s October 21 account gives more specific credit: Calif identified a critical flaw using an OpenAI model, while Wiz independently discovered and reported both PHP vulnerabilities. Crucially, the company says PHP’s maintainers led the fixes and release. OpenAI and other partners contributed research, technical support and coordination.

That response extended beyond checking code. OpenAI says it worked with infrastructure providers on protections and engaged government cyber agencies to help guidance reach critical organizations. Getting a fix into use can require adapting it for older software releases, preparing temporary protections and updating systems across many organizations.

The company’s proposed disclosure framework leaves maintainers to decide which organizations need advance information. A distributor might need time to adapt a patch; a hosting provider might need to test a temporary mitigation. Participants would receive the information needed for their protective work, rather than automatically receiving every sensitive detail.

Coordination also carries risks. OpenAI acknowledges that even limited details can reveal a vulnerability, so the protective value of sharing must be weighed against leaks. Its framework calls for reassessing disclosure timing if exploitation begins, information leaks, a public patch reveals the issue or stalled fixes increase users’ risk.