Huawei's Security Response Center announced that it received a large number of vulnerability reports this year that were produced with AI assistance; most included proof-of-concept code, but false positives caused by AI hallucinations were unavoidable. Under the new rules, AI-assisted or automated findings must undergo human analysis and verification before submission, and hunters are encouraged to supply a full exploit chain, an executable PoC, affected product versions and impact, logs and demo video. Invalid reports will be rejected outright, with reminders at three and possible account bans at five; from Sept 30, 2026, vulnerabilities in Huawei terminal tools such as DevEco are also temporarily out of scope unless they involve supply-chain poisoning of public repos or can affect device security.

Huawei·HarmonyOS·DevEco·+1