Security warnings: Node.js to combat AI flood with AI
A discussion has arisen within the Node.js community about how to proceed with the multitude of LLM-generated security reports.
(Image: Wolf Hosbach/iX/KI)
The Node.js team is currently discussing changing the workflow for the flood of submitted, LLM-generated security reports. Ideas include processing the reports publicly and pre-sorting them using artificial intelligence.
The team has now put the issue on the agenda for the next Security Working Group meeting on July 7. Initiator Rafael Gonzaga writes that all previous measures have not helped: “We are still overwhelmed.”
Therefore, he suggests publishing the submitted reports and processing them as pull requests (PRs). The submissions are often just bugs that also need to be fixed, but less about real security vulnerabilities. Moreover, so many similar reports arrive that can practically be generated by anyone with an LLM: “These findings are effectively public already.” As PRs, the community can take care of them, relieving the core team.
An AI pre-sorting could identify only the truly serious vulnerabilities and forward them to the security team for processing without public disclosure.
Videos by heise
Dissenters express concern that the proposal replaces the mass of security reports with a mass of PRs that also need to be reviewed by the core team. Furthermore, the published vulnerabilities could attract hackers, “as a free source of ideas for automated attacks.” Therefore, other maintainers suggest not involving the entire public, but expanding the circle to all collaborators.
Fighting AI Slop
Like many other projects, Node.js is struggling with AI Slop and already canceled its bug bounty program for rewarding warnings in April. Other projects have also been forced into such measures. According to Gonzaga, however, this has not brought any relief, as the submitters are more interested in the glory of appearing as the author on an official CVE warning than in money.
Other measures also failed to achieve success: higher hurdles on the HackerOne reporting platform, tighter relevance criteria, and automated closing of low-quality reports. The latter even led to more reports landing with the parent organization, OpenJS. “Soon that team will be overwhelmed too,” concludes Gonzaga.
(who)
