Curl Reviewed Five Claims. One Was a Vulnerability

HackerOne could celebrate a reported record $81 million in rewards while the maintainers of curl, an open-source data transfer tool, prepared to end their program on the platform. The market was paying more to find flaws; one project said the reports arriving through its channel were taking too much work to assess. Late-2025 coverage reported the payout; curl announced its plan in January 2026.

Bug bounties were built to solve a discovery problem: give outsiders a legitimate route to disclose security flaws and reward findings that a software owner accepts. AI has changed the cost of entering that route without eliminating the recipient’s work. A model can produce another plausible claim quickly; a maintainer must still reproduce it, check whether it is new, establish whether it is a vulnerability, and decide what to fix. Verification, rather than the supply of candidates, has become the constrained resource. Bounty programs are beginning to ration access and automate intake, but neither step establishes whether they are producing more security per hour of review.

The original bounty contract bought reach

HackerOne’s early model connected white-hat researchers with companies and took a 20% commission on bounty payments. A company gained access to people it could not employ; a researcher gained an authorized path to report a flaw. The reward followed an accepted finding. That arrangement made sense when finding and documenting a credible issue imposed meaningful work on the person submitting it.

The contract did not price every decision before acceptance. A recipient has to identify the affected version, recreate the conditions, compare prior reports, determine impact, and sometimes ask for more evidence. A rejected report can consume those hours without generating a bounty payment. For an open-source project, the person doing that work may also be the person expected to ship the fix.

Daniel Stenberg identified the mismatch early. In January 2024, the curl founder said easy access to large language models was producing junk AI-assisted bug reports that wasted developer time and energy. His warning did not require AI to be bad at finding vulnerabilities. It required only that people submitting weak claims could impose work on the people deciding whether those claims were real.

Curl’s five claims required five decisions

Curl’s January 2026 plan to end its HackerOne program followed its complaints about low-quality AI-generated submissions. In May, Stenberg published a narrower, unusually visible adjudication: manual review of five alleged curl vulnerabilities attributed to Mythos found three false positives, one ordinary bug, and one vulnerability. All five needed attention before the team could distinguish the one from the other four.

That review is not a measured false-positive rate for Mythos, much less for AI security research. The supplied record does not establish whether those five reports were AI-generated, AI-assisted, or produced under a particular testing method. Curl is one project, and its decision to leave one bounty channel cannot establish rejection rates or net security value across the market. Stenberg’s account does show precisely what a candidate total conceals: a claimed vulnerability and an adjudicated vulnerability are different units of work.

Other bounty operators have reportedly responded with tighter participant checks and AI agents for report triage. Screening can limit who enters a queue, and an agent can help sort what enters it. Neither can settle a disputed flaw merely by making the queue shorter on a dashboard; someone must be able to inspect the evidence behind the decision.

Reward ledgers record the paid half of the exchange

Late-2025 coverage put HackerOne’s rewards at a record $81 million over the preceding year, up 13% year over year. Google reported paying $10 million to 632 researchers for 2023 findings; Microsoft reported $17 million to 344 researchers between June 2024 and June 2025. Those amounts document a substantial reward economy and the continued value of outside research.

They do not disclose a common denominator. A payout total cannot show how many reports were opened, how many duplicated earlier work, how many could not be reproduced, or how long maintainers spent reaching those conclusions. It counts money transferred after an outcome, not work performed on every possible outcome. Security costs can therefore move to the recipient without appearing in the transaction that made the report worth submitting.

That distinction also protects the case for bounties. A larger payout could accompany more consequential fixes, more costly review, or both. Without comparable intake and adjudication records, neither curl’s exit nor a record reward year can resolve which effect dominates.

GitHub is differentiating access before it can prove the result

GitHub made private vulnerability reporting generally available in 2023, giving researchers a confidential path to open-source maintainers. Private delivery can reduce public exposure and make coordination easier. It does not, by itself, establish that an incoming claim is correct.

In 2026, GitHub planned a two-tier bounty program with lower public rewards and higher payouts for invite-only researchers amid a flood of AI-powered reports. The plan puts a price on a researcher’s prior record, rather than treating every point of entry identically. It also risks making entry harder for a capable newcomer; the supplied evidence does not yet show its effect on valid findings, reviewer workload, or participation.

Proof of work offers a different way to improve an individual submission. A researcher can supply an affected version, reproduction steps, an observed result, and the reasoning that makes the behavior a security flaw rather than an ordinary bug. A recipient can challenge each part. GitHub’s reported reward plan does not establish those requirements, but it makes the trade-off between open access and review capacity explicit. Agent submissions add an authorization question as well: a program must know who is accountable for an automated researcher’s work.

AI-assisted fixes make a blanket rejection untenable

Mozilla said Mythos Preview and other AI models helped it identify and ship 423 Firefox security bug fixes in April 2026, compared with 31 a year earlier. Shipped fixes sit further along the security workflow than proposed findings, although Mozilla’s comparison does not isolate Mythos’s contribution or make the two Aprils controlled experiments.

Anthropic reported 5,500 verified vulnerabilities from April through October. It also said Glasswing partners found more than 129,000 from April through July, including more than 33,000 rated critical or high severity. Anthropic reported its own and its partners’ results for different periods, with different descriptions of validation, so neither total provides a denominator for an acceptance rate. They do, however, rule out the notion that AI-assisted discovery produces only unusable reports.

Vendors are making different choices about where verification happens. OpenAI positioned Codex Security across discovery, validation, and proposed remediation. Anthropic’s opt-in OSS Scanner instead offers open-source projects AI-generated reports without human review before delivery. Opt-in consent lets a project choose whether to receive them; it does not do the project’s review. The distinction is operational: a finding delivered with a tested path and a proposed fix asks something different of a maintainer than a finding delivered as an untested possibility.

Disclosure programs need denominators before they optimize volume

The CVE Program assigned identifiers to more than 40,000 reported vulnerabilities in 2024. Its identifiers provide a valuable shared record of identified flaws, not an accounting of every candidate that an operator examined on the way to a decision. Bounty disclosures tend to make the other end of the process visible: accepted researchers and paid rewards.

A program trying to evaluate AI-assisted intake would need to publish what happens between those endpoints: total submissions, duplicates, false positives, reproduced vulnerabilities, time to first reproduction, fixes by severity, and reviewer time. Operators would also need consistent definitions and reporting periods. Otherwise, one program could count an ordinary bug as a finding while another counts only a reproduced security issue, and their totals would appear comparable when their work was not.

HackerOne’s reported $81 million paid researchers for accepted findings. Curl’s maintainers had to assess five claims before they could call one a vulnerability.