{"id":154667,"date":"2026-01-22T17:11:54","date_gmt":"2026-01-22T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/llvm-vvyol-pravila-primeneniya-ai-instrumentov-curl-i-node-js-ogranichat-vyplaty-za-uyazvimosti-iz-za-ai"},"modified":"2026-01-22T17:11:54","modified_gmt":"2026-01-22T15:11:54","slug":"llvm-vvyol-pravila-primeneniya-ai-instrumentov-curl-i-node-js-ogranichat-vyplaty-za-uyazvimosti-iz-za-ai","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/llvm-vvyol-pravila-primeneniya-ai-instrumentov-curl-i-node-js-ogranichat-vyplaty-za-uyazvimosti-iz-za-ai","title":{"rendered":"LLVM has introduced rules for the use of AI tools. Curl and Node.js will limit payments for vulnerabilities due to AI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the LLVM project have approved rules for using AI tools in development. The need for regulating the use of AI is due to an increase in the number of garbage changes proposed for inclusion in the LLVM codebase. Garbage changes refer to modifications generated by AI tools and submitted as-is, without understanding the content, verification, and adhering to the position of 'the maintainer will sort it out.' Such activity creates an increased burden on maintainers and forces them to spend time analyzing useless code. <\/p>\n
At the same time, LLVM developers acknowledge that when used properly, AI can be a useful tool that accelerates development. The conditions for using AI approved in LLVM are partly based on the rules published last year by the Fedora project. The main idea behind the adopted rules is that developers should not shift the responsibility for reviewing AI-generated code onto maintainers. <\/p>\n
In addition to the mentioned responsibility for submitted changes in Fedora's rules, LLVM has introduced a requirement for mandatory manual review of AI-generated code before proposing a change to the project. Furthermore, the person preparing the change must have a good understanding of the submitted code and be ready to answer related questions. It is recommended to manually write descriptions for pull requests rather than relying on AI to prepare accompanying text. <\/p>\n
When submitting a change, a significant portion of which is generated by AI tools, it is necessary to add information about the use of AI in the comments of the pull request, for instance, by specifying the tag 'Assisted-by: AI tool name.' The use of automated AI tools, such as the AI agent @claude integrated with GitHub, which performs actions or submits comments without human involvement, is prohibited. <\/p>\n
The adopted rules apply not only to the code in change requests but also to RFC documents proposing new functionalities, reports of vulnerabilities and bugs, comments, and feedback on pull requests. <\/p>\n
Additionally, it is worth noting the decision by Daniel Stenberg, the author of the curl utility for transferring data over the network, to discontinue the program for awarding monetary rewards for reporting vulnerabilities in Curl. The rewards will cease at the end of January due to the influx of spam submissions generated by AI assistants and sent without verification of actual vulnerabilities. <\/p>\n
It has been reported that in the first two weeks of January, 20 submissions claiming vulnerabilities were made for rewards. An analysis of these submissions showed that none contained real vulnerabilities. Authors of vulnerability reports are advised not to report issues unless they understand the essence of the problem and can reproduce the error. Reviewing such submissions consumes a lot of time for the security team. It is expected that the discontinuation of rewards will reduce the motivation for people to submit spam and poorly vetted vulnerability reports, regardless of whether they are generated by AI or not. <\/p>\n
Additionally: The Node.js project also announced restrictions on accepting submissions for vulnerability rewards, now only accepting submissions on HackerOne from high-rated participants who already have experience submitting correct problem reports (signal > 1). The reason for this change is the significant increase in the number of low-quality submissions. Reviewing spam submissions takes time and resources that could be directed toward real work to enhance platform security. From December 15 to January 15, the project received over 30 such submissions. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"