How fake security reports are swamping open-source projects, thanks to AI

Patch spam contains code that is downright wrong and nonfunctional. Even worse: It can introduce new vulnerabilities or backdoors. What's a developer to do?