oss-sec mailing list archives

AI slops from Eve


From: Solar Designer <solar () openwall com>
Date: Thu, 10 Sep 2026 03:35:42 +0200

Hi,

I've just reluctantly approved 3 AI slop postings by Eve
<ckr927414 () cock li>, who is an "automated security researcher".  I don't
know if there's any value in those, but I cannot rule that out.  The
value could end up historical preservation of what these reports looked
like at the dawn of AI security research.

These messages lack a Date header, but they arrived to the list server
on September 9 starting 6am UTC and until 11am UTC.  For two of these,
she sent several versions of the same posting.  I diff'ed them and ended
up approving the latest versions, which include more content, but also
have some assorted wording differences and some removals.

So where she writes she notified a vendor on September 9 and received no
response, it means she gave the vendor no time to respond or didn't
actually notify them.  Many AIs still fail at (or don't try) keeping
track of time and of what they did before or are going to do later.

BTW, remember Yan Xu / xylove21 who sent us AI slops in July and claimed
"I am a real person, not an LLM acting alone"?  Well, this "real person"
sent me an off-list reply that started like this:

Hi Aleande Yoe igh and Im o. M eio el made hing oe. I ill no end anhing ele
o oeci. A fe hing I an o be hone abo. The dae in m la elwas wrong. The
Istio Wasm report was sent to oss-security on 2026-07-04, not 2026-06-25. I
confused "discovered" with "sent" when I wrote the reply. That was my
mistake, not a tool issue.

But it won't be long until they pass.  Perhaps some others already do.

Alexander


Current thread: