Why vulnerability reports lost their VIP status in 2026

Key Takeaways

• LLMs can now find vulnerabilities as effectively as most security researchers, making the insight less scarce
• Attackers have the same AI tools as defenders, reducing the value of embargoes and coordinated disclosure
• The new bottleneck is triage, not discovery — maintainers must focus on rapid assessment and prevention

Vulnerability reports no longer deserve special treatment. That's the argument from Filippo Valsorda, former lead of the Go Security team at Google, who says the rise of LLMs has fundamentally changed the economics of security disclosure. The insight that security researchers once provided is no longer scarce. Anyone with access to a capable model can find bugs now.

For years, the unwritten contract was simple: researchers report vulnerabilities confidentially, maintainers respond quickly and credit them. The researcher provides valuable insight and the restraint not to drop zero-days publicly. The maintainer gets time to ship a fix before attackers weaponize the flaw. Everyone wins, and users stay safe.

That contract assumed scarcity. Finding vulnerabilities took skill, patience, and deep knowledge of the codebase. A researcher willing to share their findings privately was doing you a favor. You owed them something back.

What changed about vulnerability discovery?

LLMs broke the scarcity assumption. Valsorda is blunt: "LLMs are as good as almost any security researcher, and anyone can run them." Maintainers can run them. Attackers can run them. The insight that once made a vulnerability report special is now a commodity.

The bottleneck shifted. Finding potential issues is easy. Assessing which ones are real, exploitable, and worth fixing is hard. Unless there's an existing trust relationship, external researchers can't meaningfully contribute to that triage process. Sifting through an LLM's output looks a lot like sifting through a flooded security@ inbox.

Confidentiality matters less too. Attackers don't need to read your disclosure post to learn about a vulnerability. They can ask their own LLM. They likely have the same triage backlog as defenders. The coordinated disclosure model assumed a time advantage that may no longer exist.

How are maintainers responding?

William Woodruff, commenting on Hacker News, confirmed the shift is real: "I triage well over a dozen reports a week, many of which are 'real' in the sense that they reflect a genuine defect but otherwise have an unclear impact on a typical user." The volume has pushed him away from coordinated disclosure.

There's an upside to the flood. Because many bugs are now "shallow" to LLMs, it's easier to moderate bad actors in vulnerability programs. If someone sends low-quality AI slop, you ban them and wait for a better report on the same bug. "Imagine being able to freely ban researchers just one year ago," Valsorda notes.

Frederik Braun, on Lobsters, pushed back slightly: some vulnerability reports are still special. High-severity issues, reports from highly trusted sources, genuinely novel attack vectors. The job of security teams may now be rapid classification into special and not-special buckets.

What should security teams do now?

Valsorda's prescription is direct: triage, rapid remediation, and prevention. The days of carefully cultivating researcher relationships and managing embargoes may be fading. "We should all figure out how to run LLM analysis in CI, I suppose," he writes.

This doesn't mean ignoring reports entirely. It means recalibrating expectations. Not every reporter gets a response within 24 hours. Not every finding gets a CVE and a thank-you tweet. The obligation has shifted from "we owe researchers something" to "we owe users rapid fixes."

Avery Pennarun raised an interesting counterpoint: things will change again. Once the current wave of AI-discovered shallow bugs is cleared, the remaining vulnerabilities will be harder to find. The bar rises. But Valsorda is skeptical this stabilizes soon. As long as models keep improving, the current dynamic persists.

The broader signal for open source

This debate sits within a larger conversation about maintainer burnout. Valsorda has written extensively about open source sustainability. The old framing of every issue as an obligation, every email as a debt to be paid, was already unsustainable. Security reports were the one exception. Now even that exception is eroding.

For CTOs and engineering leaders, the implications are practical. Your security@ inbox probably contains more noise than signal. Your team should invest in automated scanning and rapid triage tooling, not elaborate disclosure coordination processes. The researchers sending you reports may be running the same tools you could run yourself.

Frequently Asked Questions

Are vulnerability reports still worth responding to?

Yes, but with different expectations. High-severity issues and reports from trusted sources still merit priority treatment. Routine findings can be triaged like any other bug.

Should companies still run bug bounty programs?

It depends. If your inbox is flooded with AI-generated reports of marginal impact, the ROI may have declined. Consider redirecting resources to internal automated scanning.

How do LLMs change coordinated disclosure?

The traditional embargo model assumed attackers needed time to learn about vulnerabilities. If attackers have the same AI tools, they may already know. Speed to fix matters more than coordination.

What tools help with vulnerability triage?

CodeQL, Semgrep, and Snyk offer automated scanning. Newer AI-native tools like Socket.dev focus on dependency risks. Integration into CI/CD pipelines is increasingly standard.

Source: Hacker News: Best