Daniel Stenberg, founder of open-source project curl, says easy access to LLMs is resulting in junk AI-assisted bug reports, wasting developer time and energy
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore.
Context & Ripple Effects
This is an early warning from curl's founder that low-friction LLM access can shift work onto open-source maintainers through report triage rather than useful contributions. Later coverage shows the concern persisting: Stenberg characterized AI-heavy HackerOne submissions as a maintainer-overwhelming flood, and curl ultimately moved to end its HackerOne bounty program amid low-quality reports.
First-order effects
- curl maintainers must spend more time assessing and rejecting low-quality AI-assisted bug reports, reducing the attention available for reproducible defects and development work.
- The immediate value of an incoming report falls when plausibly written submissions do not reliably contain valid technical findings.
Second-order effects
- Security-reporting and bounty workflows face higher screening costs as maintainers need stronger reproduction and evidence requirements before investigating claims.
- Researchers submitting well-supported reports may encounter slower responses or stricter intake rules as projects defend limited reviewer capacity.
Third-order effects
- If this pattern broadens, volunteer-maintained infrastructure may treat vulnerability reporting as an adversarial intake channel, not simply a community contribution channel.
- The episode points to a need for complementary verification and triage systems around AI-assisted code analysis; model output alone does not create trustworthy security evidence, as curl's later manual review of five reported vulnerabilities illustrates.
The trend: Generative AI is lowering the cost of producing security claims faster than open-source projects can validate them, making human triage capacity a critical constraint.