GNOME Rethinks Its Vulnerability Handling Amid a Flood of AI-Generated Reports

The GNOME project is changing how it handles vulnerability reports. The reason: a growing number of reports generated by large language models. The changes were outlined by Michael Catanzaro of Red Hat, who oversees security at GNOME.

Thirty days instead of ninety

The key change takes effect next month: GNOME is dropping the industry-standard 90-day disclosure window and moving to 30 days. The reasoning is simple — most issues in GNOME are either fixed within the first one to three weeks or never fixed at all. Stretching the deadline out to a full quarter makes no sense in that situation.

AI reports will go no further

The second change concerns projects that explicitly prohibit content created by artificial intelligence. Since many modern vulnerability reports contain findings generated by neural networks, they violate the anti-AI-contribution rules of such projects. For that reason, they will no longer be forwarded to their recipients — messages like these will be closed in the tracker straight away. Maintainers who want to will still be able to receive notifications, so that they at least know about the claimed findings.

A change of hands

Catanzaro has been tracking GNOME vulnerabilities since 2020 as part of his work at Red Hat — and he admits he is tired of the role. As of November, he will stop taking on new vulnerability reports. By December, all disclosure deadlines for issues already open will have expired, and at that point he will consider his mission complete.

The project is now looking for experienced community members willing to take up the baton. The details are laid out in a separate blog post.

Source: Phoronix