Comment by nullc

One can defend by quarantining any submitted fix, developing your own without reading it. Then only after that compare them.

In any case you don't even need malice --- sincere reporter can vibe up a fix that accidentally introduced a vulnerability, owing to their own lack of domain expertise and model errors... and then this bad fix makes it in because in the thrall of confirmation bias you fail to notice its shortcomings. Reporter also presumably tested it against their own LLM, so that will pass too.

This happened recently in a cryptocurrency project and contributed to a significant exploit.