{"id":58979,"date":"2025-07-15T22:59:09","date_gmt":"2025-07-15T22:59:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/curl-creator-mulls-nixing-bug-bounty-awards-to-stop-ai-slop\/"},"modified":"2025-07-15T22:59:09","modified_gmt":"2025-07-15T22:59:09","slug":"curl-creator-mulls-nixing-bug-bounty-awards-to-stop-ai-slop","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/curl-creator-mulls-nixing-bug-bounty-awards-to-stop-ai-slop\/","title":{"rendered":"Curl creator mulls nixing bug bounty awards to stop AI slop"},"content":{"rendered":"

Daniel Stenberg, founder and lead developer of the open-source curl command line utility, just wants the AI slop to stop.<\/p>\n

Stenberg and a handful of other curl maintainers have been overwhelmed by bogus bug reports created by individuals using generative AI tools. He and others have referred to unwanted generative AI content as “AI slop” and he\u2019s complained about the problem that poses for maintainers since January 2024<\/a>.<\/p>\n

The problem has worsened in the past year and a half, compounded by “human slop” – low-quality submissions where it isn’t obvious whether the submission came from a person or an AI model.<\/p>\n

\n

The general trend so far in 2025 has been way more AI slop than ever before<\/p>\n<\/blockquote>\n

“The general trend so far in 2025 has been way more AI slop than ever before (about 20 percent of all submissions) as we have averaged about two security report submissions per week,” he wrote in a blog post<\/a> on Monday. “In early July, about 5 percent of the submissions in 2025 had turned out to be genuine vulnerabilities. The valid-rate has decreased significantly compared to previous years.”<\/p>\n

Curl up and die?<\/h3>\n

The situation has prompted Stenberg to reevaluate whether to continue curl’s bug bounty program<\/a>, which he says has paid out more than $90,000 for 81 awards since its inception in 2019. He said he expects to spend the rest of the year mulling possible responses to the rising tide of AI refuse.<\/p>\n

Presently, the curl bug bounty program \u2013 outsourced to HackerOne – requires the bug reporter to disclose the use of generative AI. It does not entirely ban AI-assisted submissions, but does discourage them.<\/p>\n