AI-Assisted Bug Reports Are Now Good, and Overwhelming Curl

The slop is gone. The pressure isn't.

For much of the past couple of years, open source maintainers have complained about a particular kind of AI-generated nuisance: fabricated or nonsensical security reports that looked authoritative but fell apart on inspection. Curl, the ubiquitous data-transfer tool and library, became one of the most vocal critics of that trend. Now its founder says the problem has changed.

"Over the last few months, we have stopped getting AI slop security reports in the curl project," Daniel Stenberg, curl's founder and lead developer, wrote in a social media post. "They're gone." 1 What replaced them, he said, is an ever-growing stream of genuinely good security reports, nearly all of them produced with AI help. 1

That sounds like a win, and in one sense it is. But Stenberg's point is that better reports are not the same as less work. The submissions are arriving faster than ever, and each plausible one demands real scrutiny from a small group of maintainers. 1

Plausible doesn't mean exploitable

The shift moves the bottleneck rather than removing it. A junk report can often be dismissed quickly once a reviewer spots the hallucinated function or impossible code path. A well-constructed report that cites real code and describes a credible scenario has to be investigated properly before anyone can decide whether it matters.

And many still don't. Stenberg stressed that even high-quality reports frequently identify issues that are not exploitable security flaws requiring a fix, and he pointed to curl's public list of closed reports as evidence. 1 In other words, AI tools have become good at finding things that look like bugs and describing them convincingly, but the hard judgment call about real-world impact still lands on humans.

Curl isn't alone. Stenberg said other open source maintainers are seeing the same pattern, and Linux kernel maintainer Greg Kroah-Hartman recently observed that AI-assisted bug reports now contain less slop and more valid concerns. 1 Kroah-Hartman said the kernel team has been working to absorb the higher volume, while suggesting that smaller teams may be struggling to keep up. 1

That caveat matters. The Linux kernel has a large, well-organized maintainer community. Many critical open source projects depend on a handful of volunteers, or one. For them, a doubling of credible reports isn't a workflow tweak. It can become a staffing crisis.

Two responses: pause, or pay for triage

The broader ecosystem appears to be splitting on what to do about it. Google has reportedly paused intake for its open source bug bounty program, a "stop and reassess" approach to the surge. 2 The Linux Foundation has gone the other way. It launched a $12.5 million initiative to help projects such as curl and the Python Software Foundation triage AI-generated vulnerability reports rather than shut down intake. 2 The effort is backed by $5.5 million in GitHub Azure credits and Google-contributed tools including Big Sleep and CodeMender. 2

The Linux Foundation's bet, essentially, is to fight AI-generated volume with AI-assisted triage. 2 There is an irony in Google pausing its own bounty intake while supplying tooling to the foundation's fund. That reads less like a contradiction than a sign that even large players see the problem as structural, not a matter of tweaking one program's rules.

What it means

I think Stenberg's observation is more significant than the earlier slop complaints. Slop was a quality problem, and quality problems tend to fade as tools improve, which is apparently what happened. What curl faces now is a capacity problem. AI has cut the cost of producing a credible vulnerability report close to zero, while the cost of verifying one hasn't moved much. Any system where submission is cheap and review is expensive will eventually be swamped.

There are real upsides. More legitimate scrutiny of widely deployed code should, over time, mean fewer latent bugs in software nearly everyone relies on. But that only happens if someone has the hours to separate the exploitable from the merely interesting.

The funding approach looks like the more sustainable of the two responses on offer, because pausing intake doesn't make the reports, or the bugs, go away. Whether $12.5 million and a set of automated tools can scale across thousands of under-resourced projects is an open question. Automated triage could also add its own layer of plausible-but-wrong output for maintainers to second-guess. Still, the conversation has clearly moved on. The worry is no longer that AI produces garbage. It is that AI now produces good work faster than the people maintaining critical infrastructure can absorb it.