Huawei Updates Bug Bounty Rules to Combat AI False Positives
Huawei's terminal security bounty program announced new rules requiring mandatory manual analysis and verification for all AI-assisted vulnerability reports. The policy also outlines penalties, such as account bans, for researchers who repeatedly submit unverified, AI-generated spam reports. This policy addresses the surging influx of AI-generated hallucinations and low-quality bug submissions that overwhelm security review teams. It reflects a growing industry-wide challenge as automated vulnerability discovery tools become more widely accessible. Under the new rules, accounts accumulating three warnings for invalid reports will receive notices, and those reaching five invalid reports face permanent bans. Additionally, Huawei temporarily restricted bug submissions for development tools like DevEco starting September 30, 2026, unless they affect supply chains or terminal device safety.
## BACKGROUND
A bug bounty program is a crowdsourced security initiative where companies reward external security researchers for discovering and reporting software vulnerabilities. In these programs, a PoC (Proof of Concept) is code or a script demonstrating that a vulnerability actually exists and can be triggered.