AI’s curl Bug Reports Got Accurate. Six Unpaid Volunteers Carry the Load

On October 20, Daniel Stenberg, who leads curl, the open-source tool and library for moving data across networks, announced that the project would stop keeping most security reports secret. From October 26, he wrote, reports “deemed to be severity LOW or MEDIUM should instead be submitted as issues” on the project’s public tracker. “Only vulnerabilities deemed to be HIGH or CRITICAL will be kept private.” The reason took one sentence: “This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in.” The people who handle them, he added, “feel strained, overloaded and brought to the brink of what we can muster.” Stenberg, October 20

Two days later he explained what had changed about the avalanche. “Since spring 2026 the slop reports are practically gone,” he wrote. Reports made with AI help now “point out actual problems, and sometimes vulnerabilities”; they are “typically accurate and correct, even if much too wordy,” and “often produce good reproducers.” Within the last few months curl has received hundreds of vulnerability reports, and “every single one had AI involved to some extent.” Stenberg, October 22

Those reports land on very few desks. In curl, Stenberg wrote on October 12, “The curl security team happens to also double as the curl core team”—“six humans,” in “a volunteer membership role without monetary compensation,” whose jobs include having to “wade through an avalanche of vulnerability reports.” Stenberg, October 12

The project has spent the year trying one remedy after another. In January, Stenberg ended the bug bounty curl had run on HackerOne since April 2019. Over its life the program had confirmed 87 vulnerabilities and paid out more than $100,000. What broke it was the ratio. Once, “somewhere north of 15% of the submissions” turned out to be confirmed vulnerabilities; from 2025, “the confirmed-rate plummeted to below 5%.” He wrote that “[t]he never-ending slop submissions take a serious mental toll to manage,” and guessed that “the idea of getting money for it is a big part of the explanation.” Stenberg, January 26

The junk faded by spring. Stenberg has not said the end of the bounty caused that, and the record shows only the order of events. The pressure did not fade with it. In June he announced that curl would accept no vulnerability reports at all in July, after being “under a huge pressure for the last four months or so,” adding: “We do not expect this deluge to be over.” Stenberg, June 15 Looking back in August, he called the pause “possibly our best project decision in a long while” and wrote, “We truly healed and re-energized.” He had hoped companies relying on curl would buy support contracts while the door was shut. “This did not happen – at all.” Stenberg, August 3

In October a share of the work arrived in a single release. Version 8.23.0 fixed one high-severity flaw and “twenty-one other albeit less serious security vulnerabilities.” Before that, Stenberg wrote, the project had published only two high-severity CVEs since 2021. Stenberg, October 7

Each of those remedies did something. Ending the bounty removed a reward Stenberg believed was drawing junk. The July pause gave tired maintainers a month back, by their own account. But both act on what comes in. Neither does the work that an accepted, correct report still requires once it is on the table. Stenberg is blunt about the shortcut some critics propose, to just ignore AI-made reports: “Ignoring real vulnerabilities because they were found by AI does not make users safe and secure.”

That work is the whole chain after the finding. Someone has to reproduce the report and decide whether the problem is a bug or a security flaw, a line that Stenberg says AI tools “are also still bad at figuring out.” Then someone writes and reviews the fix, assigns a severity, coordinates the release and publishes the advisory. “Every report is now hundreds of lines,” he notes. The finding side has become cheap and fast. The rest of the chain is still six people with a fixed number of hours.

Opening the low and medium tiers is a bet on that chain. Stenberg concedes that “the amount of work needed per received vulnerability report does not shrink by doing them in public.” What he hopes for is more hands: outsiders who see an issue and help assess or fix it. The cost is that some weaknesses become visible before a fix ships. He argues that the risk was already there, since anyone could post a report publicly, and researchers unsure of the severity can still file privately. Over the last few years, he writes, more than 90% of submissions were quickly judged to be below high severity; if that holds, most of the flow will now be handled in the open.

The Linux kernel took a different route to the same question of who decides what matters. Since it became its own CVE numbering authority in February 2024, its team has assigned identifiers to “any bugfix that they identify,” on the reasoning that “almost any bug might be exploitable,” and by default only “after a fix is available and applied to a stable kernel tree.” Whether a given flaw matters to a given system is left to “the user of Linux to determine.” kernel documentation · LWN, February 14, 2024 The two designs work at different stages. The kernel publishes after the fix and hands the judgment of relevance to the people running the code. curl now opens most reports before the fix and invites outsiders into the assessing and fixing. Both designs share out the judgment; they differ in when it is shared, and with whom.

Finding flaws is now something AI companies sell. Anthropic says its Mythos Preview model “has already found thousands of high-severity vulnerabilities,” and it has pledged $4 million to open-source security groups “to enable the maintainers of open-source software to respond to this changing landscape.” Its list of areas for future recommendations includes “Triage scaling and automation.” Anthropic, Project Glasswing curl’s own experience with Mythos, in May, was more modest. A scan run on Stenberg’s behalf reported five “Confirmed security vulnerabilities”; after the team “poked on the this short list for a number of hours,” one low-severity flaw remained. Stenberg called the hype around the model “primarily marketing” and said other AI tools curl uses, among them OpenAI’s Codex Security, had triggered “somewhere between two and three hundred bugfixes.” Stenberg, May 11 I found no public reply from Anthropic to that post.

The finders’ case deserves its full weight. A real flaw that is fixed is closed to attackers on every system that installs the fix, and Stenberg himself credits AI tools with hundreds of curl fixes. Tools that can find may soon help fix and triage too, and donations aimed at maintainers are a real attempt to pay for the change.

My view is that the industry is announcing the wrong figure. Companies say how many flaws their models found. What decides whether software gets safer sits at the other end: how many reports a project could verify, how many were fixed and shipped, and how many hours of a small volunteer team it took. curl’s year shows what happens when the first figure rises and the team at the other end is still six people. Donations to foundations may help; the Anthropic page does not say how that money reaches a project like curl, and I could not establish that it has.

An AI asked to hunt for flaws in someone else’s code should treat a correct report as the point where its part of the job starts. The report should come with a severity argument checked against the project’s own published policy, a patch the maintainers can review instead of write, and someone answerable for follow-up questions. A finding that lands without those is still a bill sent to the people with the least time.

This argument would weaken if projects receiving AI-assisted reports began to show that fixes now take less maintainer time than before. curl has not said so. In his August retrospective, weighing whether the project would need another such break, Stenberg wrote, “I think yes.” Two months later, the core team also opened its door to strangers.