Huawei Requires Manual Verification for AI-Assisted Vulnerability Reports

Huawei's Security Response Center announced updated rules on October 14 for its Huawei Terminal Security Reward Program, citing a large number of vulnerability reports generated with AI assistance in 2026. The center said many reports included proof-of-concept (PoC) submissions, but false positives caused by AI "hallucinations" remained a problem.

Under the new rules, vulnerability reports discovered with AI assistance or automated tools must be manually analyzed and verified before submission. Huawei encourages white-hat researchers to provide complete exploit chain verification and evidence of actual security impact, including a dynamically executable full PoC, affected products and system versions with impact descriptions (affected products must be within the reward program scope and upgraded to the latest HarmonyOS version), clear reproduction steps, complete logs and screenshots or demo videos. Attack paths must start from a real attack scenario entry point and demonstrate actual security impact.

Reports generated directly by AI, those not manually reproduced or triggered via the latest callable interfaces, and those lacking verifiable evidence of actual security impact will be rejected without individual explanations. Accounts that accumulate three invalid reports will be warned, and five may result in account suspension from the reward program.

The program also adjusted its scope for tool-related vulnerabilities: starting September 30, 2026, vulnerabilities in Huawei terminal tools such as DevEco will not be accepted, except for those involving supply chain poisoning of Huawei's self-developed tool repositories or vulnerabilities that could affect the security of Huawei terminal devices through such tools.