AI flaw reporting is broken — and a new open-source tool wants to fix the plumbing.
Researchers at arXiv describe FLARE-AI, a reporting framework built after auditing 12 existing AI flaw-reporting systems from developers, cybersecurity groups, and incident registries. The audit found five recurring failures: flaws are hard to find, scope is unclear, submitted information lacks structure, stakeholders don't share what they receive, and nobody knows how to handle strict-liability cases. The team also gathered input from 49 experts across 32 organizations before designing the system. FLARE-AI uses conditional logic and early classification to collect triage-ready information, then routes a single machine-readable report to whichever developers, coordinators, or registries the reporter chooses.
The fragmentation problem is real and has practical costs. A researcher who finds the same flaw across multiple AI systems today must fill out a different form for each vendor — a friction that discourages reporting and slows remediation. FLARE-AI treats this the way coordinated vulnerability disclosure treated CVEs: standardize the format, reduce the overhead, and let information flow to the people who can act on it.
Whether AI developers actually agree to receive and act on FLARE-AI submissions is a different question — one the paper does not fully answer.