Vibe Security Researchers

In the past years, I’ve witnessed a new character appear in the open-source ecosystem: what I call the ‘Vibe security researcher.’

Not a security engineer, not a contributor, but someone who points an AI agent at popular repositories, waits for it to flag any theoretical glitch, and then publishes a dramatic ‘high‑severity vulnerability’ report to collect GitHub credit.

And it’s not because AI is suddenly uncovering deep, subtle security flaws. It’s because AI can now generate volume, and some people have learned to turn that volume into visibility. A perfect illustration is CVE-2026-41254

A Case Study: CVE‑2026‑41254

A perfect illustration is CVE-2026-41254. It involved a malicious 7-channel ICC profile that could trigger an out-of-bounds read of a few bytes. It was impossible to exploit, mostly irrelevant in practice, and, ironically, already fixed when the CVE was filed. No memory corruption, no code execution, and no real-world impact other than causing some programs to terminate with an error. Yet a self-described ‘security expert’ took this already resolved issue and turned it into a wave of noise, complete with exaggerated claims and a CVE entry that suggests far more drama than reality. He didn’t even find the issue; he simply copied it from a commit I had already made. If you are a lawyer and you think we can get some money suing this company please contact me! :-D

Seriously, I don’t mind the CVE itself; transparency is good. What wastes time is the constant stream of derivative reports, each more alarmist than the last.

The Honey‑Pot Experiment

To test whether anyone was actually reviewing the code, I added a comment in a non‑critical area:

‘This can potentially be an overflow.’

The code below looks vulnerable, but it isn’t; the data is already range checked elsewhere, so it cannot fail. Within days, I started receiving new ‘high importance vulnerability’ reports about this imaginary issue. No reproduction steps. No analysis. Just AI-generated noise presented as urgent. Nobody was reviewing these reports, and in most cases, they didn’t even reply to my emails pointing out that they should invest in a better AI.

The Real Cost

I’m not alone. Several companies maintaining open-source versions of their software have already shut down their bug-bounty programs, not because AI is finding too many vulnerabilities, but because it’s generating too much garbage. False reports waste engineering time, exaggerated issues distract from real security work, and inflated CVEs reduce trust in the process.

We need a better norm, AI can be a powerful tool for security auditing, but only when paired with expertise, context, and responsibility. Open-source maintainers are already stretched thin. What we need is signal, not noise.

And now for the worst part

MITRE and the CVE system are going through a rough period. On one side, the number of published vulnerabilities is growing rapidly. On the other, the volume of low-quality or over-interpreted reports is growing even faster. The gap between the two is becoming operationally relevant.

To ground this in data

The CVE Program reported 15,176 published CVE records in Q1 2026, up from 12,796 in Q4 2025

• FIRST estimates ~59,000 CVEs for 2026 (median forecast), with upper bounds exceeding 100,000
• NIST has formally adjusted its NVD operations due to a ~263% increase in CVE submissions (2020–2025), introducing prioritization where many CVEs will no longer be immediately enriched

In other words: the pipeline is already operating beyond its original design assumptions.

Those “vibe security researchers” are ruining the real protection. The CVE ecosystem itself is under structural strain.

Recent CVE Program reports show:

Over 300,000 CVE records exist in the database More than 500 CNAs are now actively assigning CVEs globally

This decentralization has scaling benefits, but also introduces variability in quality, consistency, and interpretation.

Finally, and this is only IMHO… If we want a healthier ecosystem, we must encourage:

• Responsible disclosure
• Human verification -Real reproducibility
• Respect for maintainers’ time

And maybe, just maybe, fewer “vibes” and more engineering.