OSS authors say newer AI audits mostly surface obscure bugs
Original title: Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann says later models find issues that need extraordinary circumstances after earlier findings were fixed.
On October 18, Peter Gutmann replied on oss-security about a proposal for a separate vulnerability-reports list amid AI-generated findings. He said newer models, after earlier issues were fixed, increasingly report obscure bugs that need extraordinary combinations of circumstances. He cited CVE-2026-92392 as an example; the snippet cuts off before describing the full trigger.
Unconfirmed: The CVE example is cut off, so its conditions and status are not established here.
- The post is a reply about list traffic from AI code audits.
- Gutmann says earlier model findings have already been fixed.
- CVE-2026-92392 is given only as a partial example.
From the original article
Posted by Peter Gutmann on Oct 18 Martin Steigerwald writes: This matches what I've experienced in discussions with other OSS authors using AI to audit their code, what's coming in now with newer models, now that the stuff that earlier models found has been fixed, is more and more obscure issues that require extraordinary combinations of circumstances to trigger.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.