The curl project, a cornerstone of open-source infrastructure, is facing a crisis that threatens its long-standing bug bounty program. An influx of low-quality, AI-generated security reports, or "AI slop," is overwhelming the project's volunteer-led security team.
According to curl's founder, Daniel Stenberg, the project has seen a dramatic increase in nonsensical and time-wasting submissions. While the bug bounty program has been successful in the past, paying out over $90,000 for 81 confirmed security fixes, the current situation is unsustainable. As of early July 2025, only 5% of all reports submitted this year have pointed to a genuine vulnerability.
The human cost of this deluge is significant. The small security team, composed mostly of volunteers, is spending an inordinate amount of time on bogus reports, leading to burnout and frustration. Stenberg has announced a period of reflection for the remainder of 2025 to determine a path forward.
The developer community has proposed various solutions, from submission fees to requiring more detailed proof-of-concept exploits. However, there is no easy answer. The curl project's struggle is a warning for the entire open-source community, as the proliferation of AI-generated content threatens to overwhelm the very systems designed to improve software security.