curl shuts down bug bounty as AI-generated vulnerability reports flood maintainer

Daniel Stenberg, who has maintained curl for over 30 years, shut down the project's bug bounty program, which since 2019 confirmed 87 vulnerabilities and paid out over $100,000. The reason is a flood of AI-generated reports: by June 2026 one arrived every 18 hours, while the confirmed rate fell below 5%.

• curl's bug bounty confirmed 87 vulnerabilities and paid over $100,000 since 2019
• By June 2026 reports arrived every 18 hours — 4–5x the 2024 rate
• The confirmed-vulnerability rate dropped from over 15% to below 5%
• In six years, no AI-generated report found a genuine vulnerability on its own