VULNpocalypse
InformationalEcosystem changeOngoing

curl ends its bug bounty over AI slop: what every maintainer should set up now

curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.

Published
Updated
Ecosystem
Open source
Exploitation
Not applicable

What happened

On 21 January 2026, curl’s lead developer Daniel Stenberg announced that the project would end its HackerOne bug bounty on 31 January. The aim was to remove the financial incentive for “made-up” reports, many of them AI-generated, which described vulnerabilities that did not exist and took maintainer time to disprove (The Register; BleepingComputer).

The same maintainer has credited more than 100 good AI-assisted reports. The problem was never AI as such. It was unverified output submitted for a reward.

In May 2026, Bugcrowd founder Casey Ellis named the wider pattern the “slopdemic” (cje.io). In October 2026, Red Hat wrote about responsible disclosure “in the age of Vulnpocalypse”, citing curl’s avalanche of reports (Red Hat).

Am I affected?

You are, if any of these apply:

  • your project has users who would care about a security bug in it,
  • you run a bug bounty or vulnerability disclosure programme, or
  • your security contact is a public issue tracker or a personal email address.

What to do now

  1. Turn on private vulnerability reporting (GitHub: Settings, then Security, then Private vulnerability reporting). Reports then arrive as draft security advisories rather than public issues, and you can collaborate on a fix privately.
  2. Publish a SECURITY.md with clear entry requirements. A minimal version:
markdown
# Security policy

Report vulnerabilities privately via GitHub "Report a vulnerability".

A report must include:
- the affected version or commit
- exact steps or a proof of concept that reproduces the issue
- the impact you observed (not only the impact you expect)

AI-assisted reports are welcome if you have run the reproduction yourself.
Reports we cannot reproduce from the steps given will be closed.
  1. Triage by reproduction, not by prose. A confident write-up with no working reproduction is the commonest shape of a slop report. Ask for the reproduction before you investigate.
  2. Don’t overcorrect. Glasswing and similar programmes are sending real bugs too. A fixed, published intake rule handles both without wasting your time or dismissing a valid report.
  3. Rethink cash rewards if you run a bounty. Payment per report is what made spam pay. Some projects now offer recognition only, or invite-only programmes.

Why this is part of the Vulnpocalypse

AI made it nearly free to produce a vulnerability report and did nothing to make it cheaper to verify one. curl’s decision is the maintainer-side face of the Vulnpocalypse: the bottleneck moved from finding bugs to triaging them, and triage still runs on volunteers’ evenings.

Sources