Curl ends bug bounty program due to AI-generated spam reports
curl's founder announced the end of the project's bug bounty program on HackerOne as of January 2026, citing an overwhelming flood of low-quality, AI-generated vulnerability reports that consumed significant team resources. The reports appeared technically plausible but described non-existent or meaningless vulnerabilities, prompting curl to eliminate the financial incentive structure driving the spam submissions.
What happened
Daniel Stenberg, founder of curl, announced on 26 January 2026 that the project will end its security bug bounty program on HackerOne effective end of January 2026.
The decision followed an influx of low-quality, AI-generated vulnerability reports. In one week, the team received 7 HackerOne reports within 16 hours, and by late January had accumulated approximately 20 such reports.
These reports appeared logically coherent and professional but contained descriptions of vulnerabilities that did not exist or were meaningless upon human review, described as 'AI Slop'.
Reported impact
The flood of AI-generated reports forced curl's security team to expend significant effort on triage and verification work.
Stenberg indicated the volume of submissions had seriously threatened the mental health and survival of the project, given the small core maintenance team.
Index analysis
The incident reflects how generative AI systems produce hallucinations that create fake vulnerability reports with convincing but false technical descriptions.
The problem arose from financial incentive structures in bug bounty programs that reward submission volume, making them susceptible to automated spam.
Governance controls
Stenberg stated that closing the bounty was intended to remove the financial incentive that made low-effort spam submissions profitable.
Under the new policy, curl will no longer offer rewards for any vulnerability reports or assist researchers in seeking compensation from third parties.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.