Loading story…
The cURL project’s maintainer Daniel Stenberg announced the termination of cURL’s vulnerability reward/bug bounty program after the security team was overwhelmed by a surge of low-effort, largely AI-generated vulnerability submissions that consumed maintainer time and created burnout risk. Stenberg stated the small open-source team could not keep up with the volume and warned that repeated low-quality submissions would lead to bans and public criticism, framing the decision as necessary to protect project sustainability and maintainer well-being.
Reporting indicates the change is being implemented via updates to cURL’s documentation (including BUG-BOUNTY.md) and will take effect at the end of January 2026, removing references to the project’s HackerOne program and stating that cURL will no longer offer rewards for reported vulnerabilities or assist researchers in obtaining compensation from third parties. The program had operated since 2019 via HackerOne and the Internet Bug Bounty, and the decision has raised concerns among users that eliminating bounties may reduce incentives for high-quality private reporting despite cURL’s widespread use across major operating systems and software stacks.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Starting February 1, 2026, cURL will stop taking new vulnerability reports through HackerOne and instead direct researchers to an internal reporting process via GitHub. Its updated security.txt states there is no monetary compensation and warns that low-quality reporters may be banned and publicly ridiculed.
cURL said it would continue accepting HackerOne security submissions through January 31, 2026, and would still process reports already in progress at that time. A pending update to BUG-BOUNTY.md removes references to HackerOne and confirms the end of rewards and third-party compensation help for new reports.
The cURL project officially announced via its GitHub repository that it would end its HackerOne bug bounty program because maintainers were overwhelmed by a surge of low-quality, often AI-generated vulnerability reports. The project said the small security team could no longer sustain the workload and needed to protect maintainer mental health and the project's long-term viability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The *cURL* project ended its bug bounty program after maintainers reported being overwhelmed by a surge of low-quality, often AI-generated submissions that consumed significant triage time without yielding actionable security findings. cURL maintainer **Daniel Stenberg** documented the decision in a GitHub change (`BUG-BOUNTY.md`) indicating the bounty would stop at the end of January 2026, citing the “torrent” of submissions and the operational burden placed on the project’s security team. Stenberg said recent bounty activity included multiple submissions that required substantial effort to assess yet did not describe actual vulnerabilities, and he expressed hope that removing financial incentives would reduce “crap and non-well researched reports,” whether AI-generated or not. While acknowledging that AI can sometimes assist in finding legitimate bugs, he encouraged researchers to continue reporting **real security vulnerabilities** even without payment, noting that the impact of ending the bounty on future reporting quality remains to be seen.
Jun 29, 2026
Security teams and bug bounty programs are confronting a rise in AI-generated vulnerability submissions that appear technically credible but often cite nonexistent functions, commits, CVEs, attack paths, or impacts without reproducible evidence. The low cost of producing these reports shifts substantial verification work to expert triagers; curl, Node.js, and Hibernate have been cited as affected projects. HackerOne and Bugcrowd are responding with reputation, workflow, and machine-learning-based filtering, while valid AI-assisted discoveries still require concrete data-flow analysis and a working proof of concept, as demonstrated by `CVE-2024-10099` and `CVE-2024-10131`. Chrome's Security Team has published procedures for an anticipated influx of AI-generated reports in its internal processes and Vulnerability Rewards Program. It directs teams to fix S0 issues within one week and S1 issues within four weeks, initially handle reports lacking proof-of-concept code as security bugs, define security boundaries in `SECURITY.md`, and use invalid-report decisions as AI training and evaluation data. AI-generated findings receive the same disclosure treatment as human submissions, with publication 30 days after a fix, while the guidance also covers duplicates, disabled features, external dependencies, and rapid mitigations such as replacing renderer-reachable `DCHECK` assertions with `CHECK` assertions.
Sep 23, 2026
GitHub has overhauled its bug bounty program, reducing public-program payouts, replacing variable reward ranges with fixed amounts by severity, and creating a permanent invite-only VIP tier for researchers who consistently deliver high-impact findings. The company said the changes are intended to reduce triage pressure, improve researcher experience, and strengthen collaboration with trusted contributors, with the new structure applying to reports submitted on or after July 27, 2026. Under the revised model, top rewards are being concentrated in the VIP program, which offers higher payouts, faster engagement, and closer access to GitHub’s security engineering team, while public submissions will face stricter quality controls. GitHub is also requiring stronger HackerOne signal from participants to curb low-effort and AI-generated reports, reflecting broader industry concern that automated and commoditized vulnerability discovery is increasing report volume while making validated, product-specific findings more valuable.
Jul 25, 2026