An interview with curl project founder Daniel Stenberg, who likens “AI slop” in HackerOne submissions to a DDoS attack, echoing Seth Larson and others' concerns
“A threshold has been reached. We are effectively being DDoSed. If we could, we would charge them for this waste of our time …
Context & Ripple Effects
This is an escalation of Stenberg’s earlier warning that easy access to LLMs was producing junk AI-assisted bug reports for curl. The significance is not merely that reports are wrong, but that review capacity becomes the constrained resource in a security disclosure channel.
The concern sits alongside broader evidence that AI-generated output can create security noise as well as useful research: the related coverage documents AI-hallucinated package names being turned into supply-chain traps.
First-order effects
- curl maintainers and HackerOne triagers must spend more time validating low-quality submissions, reducing capacity for legitimate vulnerability reports.
- Reporters whose findings cannot be reproduced or substantiated face a higher practical bar for acceptance as maintainers protect their review time.
Second-order effects
- Bug-bounty platforms and participating projects are pressured to improve intake filtering and proof requirements, because unfiltered AI-assisted volume shifts verification costs onto maintainers.
- Smaller open-source projects may be especially exposed: unlike well-resourced security teams, they have limited ability to absorb a surge in speculative reports without delaying other work.
Third-order effects
- If the pattern persists, vulnerability disclosure programs may move from open-volume intake toward stronger evidence gates and more selective researcher access, trading reach for signal quality.
- The episode points to a broader security-economics problem: generative tools can increase the supply of plausible claims faster than human experts can validate them, making trusted triage infrastructure more important.
The trend: AI is expanding both security research output and the volume of low-confidence security claims, forcing disclosure systems to optimize for verification rather than submission volume.