Flood of AI Bug Reports in QEMU Called a DoS Attack on Maintainers

The burden that AI agents place on the maintainers of open projects has been given a new name. Daniel Berrangé, an engineer in Red Hat's virtualization group, has called the mass influx of automatically generated bug reports a “denial-of-service attack” on maintainers.

The trigger was an incident involving QEMU. According to Berrangé, a single user filed more than 125 separate bug reports in under ten minutes. They all concerned Undefined Behavior Sanitizer (UBSan) output — warnings and assert firings — but not one of them raised a genuinely serious problem.

Reports with no analysis and no fixes

What was especially telling was what these reports lacked. They ignored the bug-filing template, showed no trace of a human working through the UBSan output, and offered not a single fix. In other words, the machine dutifully dumped raw sanitizer warnings, leaving it to the people on the other end to make sense of them.

“QEMU has just hit a case of a single author filing more than 125 separate bug reports in less than 10 mins, all against ubsan output. The reports ignored the template, showed no signs of human analysis of the ubsan output, and contained no proposed fix,” the engineer wrote on Mastodon. His conclusion was blunt: “This is effectively a denial of service attack against the project maintainers.”

Over the course of a single day, 132 bug reports came in from a user going by the names C4oy1zZ / anwardawa981, many of them created just seconds apart. The account was reported to GitLab for abuse.

What they propose doing

Berrangé sees an obvious technical fix: GitLab should cap the number of bug reports a single author can open if they are not a project member. A simple rate limit would head off avalanches like this without getting in the way of ordinary users.

The episode adds to a growing string of complaints from maintainers about how AI and large language models are changing the nature of their work. The low barrier to generating “reports” means the value of any individual submission falls, while the burden on the real people who have to sift through it all rises. Automating the creation of problems has turned out to be far easier than automating their solution.

Source: Phoronix