Curl Ends Bug Bounty Program Due to AI-Generated Slop Reports

The popular curl command-line utility and library, widely used in North East India and across the world, has announced the termination of its HackerOne security bug bounty program. The move comes in response to an overwhelming influx of low-quality AI-generated vulnerability reports.

Overwhelming AI-Generated Reports

Daniel Stenberg, curl's founder and lead developer, revealed that these low-quality reports, often AI-generated, have strained the curl security team. In a recent post to his personal mailing list, Stenberg explained that these reports have increased significantly, leading him to withdraw from the program.

Impact on Open-Source Projects

The issue of AI-generated slop reports is not unique to curl. As open-source projects become increasingly popular, they are also becoming targets for AI-generated low-quality reports. This trend could potentially impact the North East region, home to several vibrant open-source communities.

Reducing the Noise

To reduce the influx of low-quality reports, curl will no longer offer rewards for reported bugs or vulnerabilities. The project will also stop aiding security researchers to obtain compensation from third parties for curl-related issues.

Transition to Internal Submission Process

From February 1, 2026, the curl project will no longer accept new HackerOne submissions and will instead ask researchers to report security issues directly through GitHub. This shift to an internal submission process aims to reduce the noise and incentivize well-researched reports.

Implications for the Future

The decision by curl to terminate its bug bounty program due to AI-generated slop reports raises questions about the future of such programs. As AI continues to evolve, it is crucial for organizations to develop strategies to combat the flood of low-quality, AI-generated content.