Don’t Insert Crazy! On cURL and AI Slop - Daniel Stenberg

After AI-generated reports dropped the signal-to-noise ratio to less than one in twenty, the creator of cURL shut down his bug bounty program.

#1about 1 minute

Why the cURL project shut down its bug bounty program

The bug bounty program was closed due to an overwhelming volume of low-quality, AI-generated security reports that made triage unsustainable.

#2about 4 minutes

Understanding the problem of AI-generated "slop" reports

AI chatbots generate reports with hallucinated vulnerabilities, made-up function names, and false positives based on common C functions like strcpy.

#3about 3 minutes

The high operational cost of managing low-quality submissions

AI-generated reports are often long and elaborate, creating a significant time burden for maintainers who must manually verify each invalid claim.

#4about 7 minutes

Moving vulnerability reporting from HackerOne to GitHub

The new process for reporting vulnerabilities will be through GitHub, without the financial incentives previously provided by the Internet Bug Bounty fund.

#5about 11 minutes

How AI threatens the sustainability of open source projects

AI-generated code can disrupt the open source model by reducing feedback loops, creating licensing ambiguity, and undermining ad-based revenue streams.

#6about 3 minutes

Monetizing open source with commercial support contracts

A sustainable monetization model for foundational projects like cURL involves selling long-term support and expert assistance to businesses that rely on the software.

#7about 3 minutes

Planning for project continuity and the bus factor

The cURL project ensures its longevity through a core team of trusted contributors and a well-documented, open process, mitigating the risk of a single point of failure.

#8about 8 minutes

The future of cURL security without a bounty program

Maintainers are not concerned about a drop in quality reports, as genuine researchers are often motivated by more than money and many reported bugs are historical or API misuse.

#9about 5 minutes

The responsibility of researchers to validate AI findings

Security researchers using AI tools must take responsibility for verifying the claims and reproducing the issues before submitting reports to avoid wasting maintainer time.

#10about 2 minutes