“These reports appear at first glance to be potentially legitimate and thus require time to refute.”
Seth Larson at the Python Software Foundation sees fewer than ten AI-written security reports a month. Each one still eats volunteer time to disprove. Curl’s Daniel Stenberg was arguing with a likely automated submitter on December 8, nearly a year after he first complained. A fake bug costs nothing to generate and a maintainer’s evening to refute.