Loading story…
The cURL project ended its bug bounty program after maintainers reported being overwhelmed by a surge of low-quality, often AI-generated submissions that consumed significant triage time without yielding actionable security findings. cURL maintainer Daniel Stenberg documented the decision in a GitHub change (BUG-BOUNTY.md) indicating the bounty would stop at the end of January 2026, citing the “torrent” of submissions and the operational burden placed on the project’s security team.
Stenberg said recent bounty activity included multiple submissions that required substantial effort to assess yet did not describe actual vulnerabilities, and he expressed hope that removing financial incentives would reduce “crap and non-well researched reports,” whether AI-generated or not. While acknowledging that AI can sometimes assist in finding legitimate bugs, he encouraged researchers to continue reporting real security vulnerabilities even without payment, noting that the impact of ending the bounty on future reporting quality remains to be seen.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The cURL project's bug bounty program was set to terminate at the end of January 2026 as part of an effort to reduce noise and remove incentives for poorly researched submissions. Stenberg said he still hoped researchers would continue reporting legitimate vulnerabilities without payment.
Daniel Stenberg said the cURL project would end its bug bounty program at the end of January 2026 after an influx of low-quality, often AI-generated submissions created significant review overhead. He communicated the decision in a GitHub commit and a mailing list message, saying recent bounty reports did not describe actual security vulnerabilities.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The *cURL* project’s maintainer **Daniel Stenberg** announced the termination of cURL’s vulnerability reward/bug bounty program after the security team was overwhelmed by a surge of low-effort, largely **AI-generated** vulnerability submissions that consumed maintainer time and created burnout risk. Stenberg stated the small open-source team could not keep up with the volume and warned that repeated low-quality submissions would lead to bans and public criticism, framing the decision as necessary to protect project sustainability and maintainer well-being. Reporting indicates the change is being implemented via updates to cURL’s documentation (including `BUG-BOUNTY.md`) and will take effect at the end of January 2026, removing references to the project’s **HackerOne** program and stating that cURL will no longer offer rewards for reported vulnerabilities or assist researchers in obtaining compensation from third parties. The program had operated since 2019 via HackerOne and the Internet Bug Bounty, and the decision has raised concerns among users that eliminating bounties may reduce incentives for high-quality private reporting despite cURL’s widespread use across major operating systems and software stacks.
Jun 29, 2026
Security teams and bug bounty programs are confronting a rise in AI-generated vulnerability submissions that appear technically credible but often cite nonexistent functions, commits, CVEs, attack paths, or impacts without reproducible evidence. The low cost of producing these reports shifts substantial verification work to expert triagers; curl, Node.js, and Hibernate have been cited as affected projects. HackerOne and Bugcrowd are responding with reputation, workflow, and machine-learning-based filtering, while valid AI-assisted discoveries still require concrete data-flow analysis and a working proof of concept, as demonstrated by `CVE-2024-10099` and `CVE-2024-10131`. Chrome's Security Team has published procedures for an anticipated influx of AI-generated reports in its internal processes and Vulnerability Rewards Program. It directs teams to fix S0 issues within one week and S1 issues within four weeks, initially handle reports lacking proof-of-concept code as security bugs, define security boundaries in `SECURITY.md`, and use invalid-report decisions as AI training and evaluation data. AI-generated findings receive the same disclosure treatment as human submissions, with publication 30 days after a fix, while the guidance also covers duplicates, disabled features, external dependencies, and rapid mitigations such as replacing renderer-reachable `DCHECK` assertions with `CHECK` assertions.
Sep 23, 2026
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026