The curl project, one of the most widely-used open source tools in the world, is ending its HackerOne bug bounty program on January 31, 2026. Creator Daniel Stenberg cited an unmanageable flood of AI-generated vulnerability reports that waste volunteer maintainers' time.
In the first 21 days of 2026 alone, curl received 20 AI-generated submissions—seven in a single week—none describing actual vulnerabilities. By mid-2025, roughly 20% of all reports were AI slop. In July, submissions surged to eight times the normal rate. Over six years of AI-assisted reports, not a single one discovered a genuine bug when AI was used alone.
The program distributed $86,000 across 78 confirmed vulnerabilities during its six-year run. Starting February 1, researchers must report security issues directly through GitHub instead. Stenberg hopes this removes "the incentive for people to submit crap" and protects maintainers' mental health. Security researcher Harry Sintonen warns this could "easily kill the whole concept of bug bounties" if the AI noise problem spreads.