XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?

Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

#7

Post by triknomeister » Tue, Jun 24, 2025, 6:17 PM UTC

ryandrake wrote: post #6

Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?

Eventually projects who can afford the smugness are going to charge people to be able to talk to open source developers.

Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

#8

Post by mkagenius » Tue, Jun 24, 2025, 6:19 PM UTC

> XBOW submitted nearly 1,060 vulnerabilities.

Yikes, explains why my manually submitted single vulnerability is taking weeks to triage.

Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

#9

Post by jgalt212 » Tue, Jun 24, 2025, 6:22 PM UTC

ryandrake wrote: post #6

Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?

One would think if AI can generate the slop it could also triage the slop.

Re: XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

#10

Post by teeray » Tue, Jun 24, 2025, 6:22 PM UTC

ryandrake wrote: post #6

Receiving hundreds of AI generated bug reports would be so demoralizing and probably turn me off from maintaining an open source project forever. I think developers are going to eventually need tools to filter out slop. If you didn’t take the time to write it, why should I take the time to read it?

You see, the dream is another AI that reads the report and writes the issue in the bug tracker. Then another AI implements the fix. A third AI then reviews the code and approves and merges it. All without human interaction! Once CI releases the fix, the first AI can then find the same vulnerability plus a few new and exciting ones.