Plenty of issues that have been patched recently found using such tools as well. OpenBSD's policy remains largely the same as always: You need to understand the patch you propose and it needs to be maintainable. The link elsewhere in this thread is mainly discussing large patches where it is unclear if the LLM drew too heavily on code elsewhere.
replyOpenBSD's errata list has recently started growing rapidly, and the scale is a real departure from the past. I have taken to running syspatch much more regularly than in the past. Anyway, it's clear that the project's stance on AI is "as long as reports are detailed and high-quality (and probably from a person with a record of such work) the project will act on it." See slide 17 here: https://events.eurobsdcon.org/media/2026/submissions/ZGDXQR/...
replyNeat little link trick for PDFs:
replyhttps://events.eurobsdcon.org/media/2026/submissions/ZGDXQR/...
Talked to bluhm@ after that talk in Brussels and the general feeling (from what I can remember from the conversation) so far is that there is a large increase in overall reports (good and bad), but that the severity of what is reported has not really increased. This also mirrors my own experience from reading source-changes@. In essence, it seems like we have known how to build secure software for the last thirty or so years, just that most do not seem to have bothered to do so.