cURL scraps bug bounties as AI slop overwhelms security team with fake vulnerability reports

cURL Terminates Bug Bounty Program Amid AI-Generated Report Surge

The open-source project cURL is discontinuing its bug bounty program at the end of January 2026, citing an overwhelming flood of AI slop that has strained its small security team beyond capacity1

1

. Daniel Stenberg, founder and lead developer of the command-line tool, announced the decision to protect maintainers' mental health and ensure the project's survival1

1

.

"We are just a small single open source project with a small number of active maintainers," Stenberg explained. "It is not in our power to change how all these people and their slop machines work. We need to make moves to ensure our survival and intact mental health"1

1

. The decision marks a significant shift for one of the Internet's most essential networking tools, first released three decades ago and now integrated into default versions of Windows, macOS, and most Linux distributions1

1

.

Low-Quality Vulnerability Reports Overwhelm Security Team

The impact on open-source projects became evident when the cURL security team received seven HackerOne issues within a sixteen-hour period in early 2026, bringing the total to twenty submissions2

2

. While some appeared legitimate initially, none ultimately identified actual vulnerabilities2

2

. The avalanche of AI-generated bug reports forced the team to spend considerable time investigating manufactured problems rather than addressing genuine security concerns.

Stenberg had warned about this trend as early as May 2025, stating that "AI slop is overwhelming maintainers today and it won't stop at curl but only starts there"1

1

. The project documented numerous examples of specious reports, with one team member responding to a submission: "I think you're a victim of LLM hallucination." The report contained code snippets that wouldn't even compile and changelogs that didn't match reality1

1

.

Financial Rewards Created Perverse Incentives

The GitHub advisory announcing the program's end explained that financial rewards inadvertently created harmful incentives: "We have concluded the hard way that a bug bounty gives people too strong incentives to find and make up 'problems' in bad faith that cause overload and abuse"2

2

. Stenberg clarified that removing the bounty aims to eliminate the incentive for submitting poorly researched reports, whether generated by Generative AI or not2

2

.

As of February 2026, all bug reports will move directly to GitHub with no financial rewards offered2

2

. The project warned potential abusers: "We will ban you and ridicule you in public if you waste our time on crap reports"1

1

.

Implications for Open-Source Security Programs

While Stenberg isn't opposed to all AI-assisted security research—he praised researcher Joshua Rogers in September for using AI-powered code analyzer ZeroPath to identify 22 legitimate bugs—he distinguishes between thoughtful tool usage and lazy automation. "A clever person using a tool," versus "people just asking an AI bot without caring or understanding much about what it reports"1

1

.

The decision has sparked concern among cURL users who worry about losing a key mechanism for maintaining security in such a widely-deployed tool. Security researchers rely on bug bounties as both incentive and validation for their work. However, Stenberg indicated his team had little choice given their limited resources.

This development may signal broader challenges ahead for open-source security programs. Just as AI slop has flooded music-streaming services with misattributed songs, making platforms increasingly unusable for discovery, bug bounty programs face similar degradation1

1

. Other projects with small maintainer teams should watch how this experiment affects cURL's security posture and whether alternative approaches emerge to balance quality control with community-driven vulnerability discovery.