curl ends its bug bounty after a flood of AI 'slop' reports
After seven years and 87 confirmed vulnerabilities, the widely used networking tool closed its HackerOne bounty, saying the volume of low-quality machine-generated submissions had made triage unsustainable.
- Security & misuse
- Culture & impact
- Notable
Daniel Stenberg, the creator and lead maintainer of curl — the small networking tool that ships inside billions of devices, from cars to phones to servers — announced that the project would close its bug bounty program on 31 January 2026. The reason he gave was not a lack of interest but a surplus of the wrong kind: a rising tide of vulnerability reports that were plausible-sounding, technically worded and, on inspection, worthless. Stenberg calls them “AI slop” — reports generated by asking a chatbot to find a security flaw and forwarding whatever it produces, with little or no human checking.
The program had run since April 2019 in partnership with HackerOne, paying out more than $100,000 for 87 confirmed vulnerabilities. But the signal had been degrading. Where historically well over one in seven reports was genuine, in 2025 the confirmed rate fell below one in twenty, even as the raw volume of submissions climbed sharply — a pattern curl saw and comparable open-source programmes, Stenberg noted, largely did not. The reward, up to $10,000 for a critical bug, had turned into a bounty on the maintainers’ attention: someone could point a model at the codebase, submit its output, and cost the team hours of investigation at no cost to themselves.
Stenberg was blunt about the toll. “The never-ending slop submissions take a serious mental toll to manage and sometimes also a long time to debunk,” he wrote, describing a convergence of “three bad trends”: the slop itself, submitters putting in less effort than ever, and a will “to poke holes rather than to help.” curl would keep accepting security reports through GitHub’s private disclosure channel and by email — but without cash rewards, removing the incentive that had drawn the volume.
curl was the most prominent case but not an isolated one. Through 2025 and into 2026 maintainers of other widely relied-upon projects described the same drain, and the episode became a reference point in a broader argument: that the same coding models making it trivial to produce software were also making it trivial to produce convincing-looking noise, and that the volunteers who keep critical infrastructure running were absorbing the cost.