The curl project plans to end its HackerOne bug bounty program at the end of January, citing a surge in low-quality AI-generated vulnerability reports
The developer of the popular curl command-line utility and library announced that the project will end its HackerOne security bug bounty program …
Context & Ripple Effects
curl's maintainers had already warned that easy access to LLMs was producing junk AI-assisted bug reports that consumed project time. The later characterization of low-value HackerOne submissions as an AI-slop DDoS on maintainers makes this a culmination of a documented operating problem rather than an isolated policy change.
The significance is concentrated in an open-source maintainer's capacity to validate security claims: a bounty channel only works when the cost of triage remains proportionate to the useful findings it delivers.
First-order effects
- curl will stop using its HackerOne bounty program at the end of January, removing that paid submission route for researchers targeting the project.
- Maintainers can redirect time from screening low-quality reports, while HackerOne loses a visible open-source program from its platform.
Second-order effects
- Other bounty-program operators facing similar report-volume pressure will have stronger reason to add stricter intake rules, reproducibility requirements, or more manual filtering before reports reach maintainers.
- Researchers using automated or AI-assisted discovery will face a sharper distinction between evidence-backed findings and bulk submissions, as low-signal traffic raises review costs for every participant.
Third-order effects
- Bug bounty programs may increasingly compete on the quality of their validation and routing systems, not only on reward pools or researcher reach, if AI lowers the cost of generating plausible reports faster than projects can assess them.
- This points toward rules-based quality guardrails for security disclosure: without effective filtering, smaller open-source projects may limit or exit public bounty channels rather than absorb expanding triage workloads.
The trend: AI is shifting vulnerability disclosure from a scarcity-of-findings problem toward a quality-control and maintainer-capacity problem.