> No, AI assistance is NOT welcome in general.

Can you cite that? I see them specifically welcoming AI security reports; I don't see any evidence that other AI submissions are not welcome.

They plainly, explicitly welcome it:

"Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes."

Why is AI assistance not welcome?

You need to understand that they have no choice.

Attackers are going to use AI models to find bugs or 0 days quicker than those without it and of course they will not report them.

So it only makes sense to allow it and accept (valid) AI reports from reputable security researchers to keep ahead before a bug gets exploited in a vulnerable release.

As long as the submitter shows their understanding of the reported bug means and what the change is, it is fine to do so, with the reviewers gating invalid reports.

> so using AI like ASAN etc. is welcome.

AddressSanitizer is not "AI", nor does it use AI. [0]

[0] https://static.googleusercontent.com/media/research.google.c...