This change is driven by a surge in CVE * submissions *, which increased 263% between 2020 and 2025.
Emphasis mine.
Your link doesn’t refute what I said. I acknowledged that there is an increase in bugs being found. That’s inevitable when you add a new tool.
My argument is that the framing is overblown. Sure, the submissions increased 263%, but how many of those are duplicate issues? Is it more like a 22% increase in actual bugs being found, with each being duplicated a dozen times of average? Big numbers are what get attention, but when you only frame an argument around the big number you lose a lot of the context.
I recall either Lutris or Heroic games launcher actually seeing a (probably temporary) spike in bugs being found due to AI, but they were getting swamped by the same bugs being reported over and over in a short timespan. Each of those reports need to be looked over with the same amount of scrutiny, so flooding a repository with duplicate issues becomes a major drain on dev resources.
Also, working in software myself, you always see a spike in issues when you first add a new test or check to your code. Then as you resolve those issues they drop back down. That’s not that different from what we’re seeing here with AI bug reporting
NIST has already updated their CVE policies because of “record CVE growth”.
Hmmmm, I wonder wtf happened during those years?
Emphasis mine.
Your link doesn’t refute what I said. I acknowledged that there is an increase in bugs being found. That’s inevitable when you add a new tool.
My argument is that the framing is overblown. Sure, the submissions increased 263%, but how many of those are duplicate issues? Is it more like a 22% increase in actual bugs being found, with each being duplicated a dozen times of average? Big numbers are what get attention, but when you only frame an argument around the big number you lose a lot of the context.
I recall either Lutris or Heroic games launcher actually seeing a (probably temporary) spike in bugs being found due to AI, but they were getting swamped by the same bugs being reported over and over in a short timespan. Each of those reports need to be looked over with the same amount of scrutiny, so flooding a repository with duplicate issues becomes a major drain on dev resources.
Also, working in software myself, you always see a spike in issues when you first add a new test or check to your code. Then as you resolve those issues they drop back down. That’s not that different from what we’re seeing here with AI bug reporting
https://depthfirst.com/research/21-zero-days-in-ffmpeg
All of these legit. Some of these from decades ago.
At this point I’m pretty sure you’re not actually reading my response and just talking past me.
Go ahead and keep arguing specters if it makes you feel better. It doesn’t change reality, but it’ll at least make you feel better