Physix FrontierPhysix Frontier · News Briefing Card (IT Home · Oct 14, 2026)
Huawei Requires Human Verification for AI-Assisted Bug Reports
KEY FACTS
- Huawei Security Response Center has issued new rules for handling vulnerability reports under its terminal security reward program.
- Huawei says it has received a large number of AI-assisted vulnerability reports this year, most of which include PoCs.
- Huawei says AI hallucinations have caused some reports to contain false positives.
- The new rules require that AI-assisted vulnerability reports undergo human analysis and verification before submission.
- Accounts that accumulate 5 invalid reports will be banned.
- Starting September 30, 2026, vulnerabilities in terminal tools such as DevEco will temporarily not be accepted.
KEY DATA
3 reportsInvalid report warning threshold
5 reportsInvalid report ban threshold
September 30, 2026Effective date of suspension for tool-related vulnerabilities
PHYSIX OBSERVATION
AI-generated vulnerability reports in bulk are diluting the signal-to-noise ratio of crowdsourced testing platforms. Huawei is using the threat of account bans to force white hats back to human verification. In the short term, this will drive away a wave of "AI-spam" accounts; in the long term, it may push the industry to establish verification standards for AI-assisted reports. For genuine researchers, concentrating review resources on valid vulnerabilities is actually a good thing.
Source: IT Home report