Why Curl Is Pausing Security Bug Reports From AI Agents

For most of 2025 and into 2026, the maintainers of curl — the tiny, ubiquitous data-transfer tool that ships inside roughly everything connected to the internet — have been fighting a problem that didn't exist a few years ago: a flood of confident, detailed, and entirely fake security bug reports written by AI. In June 2026 the project did something telling. It announced it would simply stop accepting security reports on HackerOne for a month to give its volunteers a break. Daniel Stenberg, curl's creator, called it the "summer of bliss."

What happened: a maintainer pressing pause on AI slop

curl's bug-bounty program runs on HackerOne, where researchers report vulnerabilities in exchange for recognition and bounties. As Cybernews and others reported, the project announced it won't accept or handle any HackerOne reports between July 1 and August 3, 2026. This is the latest move in a long-running fight: through 2025, AI-generated "slop" reports — vulnerability writeups produced by LLMs describing bugs that don't actually exist — overwhelmed the team. Stenberg has said that at the peak, roughly 20% of submissions were AI slop, and that triaging each one cost the team anywhere from 30 minutes to several hours of work spread across seven people.

The pressure was enough that curl ended its HackerOne bounty program at the end of January 2026, briefly experimented with taking reports through GitHub instead, found that didn't work either, and returned to HackerOne in March — only to schedule a month off in summer. The point isn't that curl gave up; it's that a foundational project keeps having to rearrange its entire disclosure process around the volume of machine-generated noise.

Why it matters: the economics of responsible disclosure are breaking

Responsible disclosure depends on an asymmetry that AI has quietly inverted. Historically, finding and writing up a real vulnerability was expensive — it took skill and hours — while reading a report was relatively cheap. That imbalance is what made bug bounties workable: serious reports were rare enough that maintainers could afford to read each one carefully.

Generative AI flips it. Producing a plausible-looking, well-formatted, technically-worded vulnerability report now costs the submitter almost nothing. Verifying that report — reading the code, checking the claimed flaw, reproducing or disproving it — still costs the maintainer the same painstaking hours it always did. When fakes are cheap to generate and expensive to debunk, volunteers drown. And the people producing slop are often chasing bounties or résumé padding, so they're incentivized to keep flooding.

This hits open source hardest because the triage labor is volunteer and unpaid, and the projects involved — curl, OpenSSL, and their peers — are exactly the infrastructure the rest of the software world is built on. Maintainer burnout in these projects isn't a community-culture issue; it's a supply-chain risk.

The thing AI is supposed to be good at, done badly

There's a real irony worth being precise about. AI can genuinely help with vulnerability research — used carefully, models help triage, summarize, and surface candidate issues. The failure mode isn't "AI in security"; it's unverified AI output submitted as fact. The reporter never confirmed the bug was real, never reproduced it, never read the code closely enough to know the model had hallucinated a CVE that doesn't exist. The same dynamic shows up elsewhere: Cybernews noted that the 24-billion-record credential leak it surfaced in June 2026 even contained thousands of documents pairing CVE IDs with GitHub URLs — a reminder of how much low-quality, machine-shaped security "content" is sloshing around.

The lesson for anyone using AI to help with security work — or any technical reporting — is the same discipline curl is now forcing on its submitters: verify before you send. An AI draft is a hypothesis, not a finding. Reproduce the issue, confirm the affected code path actually exists, and don't submit anything you haven't checked yourself. Submitting unverified model output to a volunteer maintainer isn't research; it's offloading your verification cost onto someone who didn't agree to pay it.

What to watch next

Expect more projects to add friction: mandatory proof-of-reproduction, checkboxes attesting a human verified the report, paid or reputation-gated submission, and outright pauses like curl's. Some of this will slow legitimate researchers too — that's the cost of the slop. The healthier long-term fixes are platform-side: HackerOne and similar platforms building better filtering, and a community norm that an AI-assisted report you didn't verify is not a report at all.

Bottom line

curl pausing security reports is a small project drawing a boundary that the whole ecosystem will eventually have to draw. AI made writing a fake vulnerability report nearly free while leaving the cost of debunking it untouched, and that broken economics lands squarely on unpaid maintainers of critical infrastructure. The fix isn't banning AI from security work — it's refusing to treat unverified model output as a finding. Reproduce it, confirm it, or don't send it.

Sources and further reading