The post argues that vulnerability reports used to be special because they combined scarce insight with private disclosure. The author says that bargain is breaking down. LLMs can now surface many of the same shallow bugs that junior or mediocre researchers used to find, so the scarce thing is no longer discovery. It is separating real, exploitable issues from endless low-quality reports. That makes confidential disclosure less valuable than it was, because many findings are already close to public in practice once a model can reproduce them cheaply.
That landed with a lot of people dealing with security inboxes in the real world. Founders, maintainers, and security engineers described being flooded with polished but junk reports, often clearly generated by AI or by bounty hunters spraying scanner output. Several said the workload has shifted from occasionally handling a meaningful report to spending days every week triaging garbage just in case one message contains something real. A recurring complaint was that vulnerability databases and scanners amplify the problem by assigning scary severity to edge cases, especially
ReDoS and dev-dependency issues that are technically true but operationally irrelevant for many teams. The mood was not anti-security so much as anti-undifferentiated noise.
Where the conversation settled was narrower than the post's strongest claim. People broadly accepted that report volume and duplicate shallow findings have broken the old norm of treating every disclosure like a rare favor. They did not accept that human researchers, confidentiality, or coordinated disclosure have become unimportant. The strongest pushback was that good researchers still add value by proving exploitability, scoping impact, and doing the triage work that AI does badly. Several operators said the practical response is not to abandon disclosure programs, but to harden them: require better evidence, automate spam filtering, classify findings by actual threat model, and invest in trust relationships with a smaller number of researchers whose reports consistently clear the noise. The bigger shift is that security teams can no longer afford to treat every reported defect, every
CVE, and every dependency alert as equivalent.