Open source project curl is sick of users submitting "AI slop" vulnerabilities

Abstraction: curl maintainer banning AI-generated fake security reports

Key points:

• Daniel Stenberg, curl's lead maintainer, declared the project is being effectively DDoSed by AI-generated vulnerability reports via HackerOne
• "We still have not seen a single valid security report done with AI help," Stenberg wrote
• New policy: reporters suspected of using AI must verify; those deemed to submit "AI slop" will be banned
• Example report claimed a "novel exploit leveraging stream dependency cycles in HTTP/3" but cited nonexistent functions and a patch that didn't apply to current code
• The AI-generated submission answered questions not asked, gave basic git instructions unprompted, and recommended hardening for tools other than curl
• curl turned 25 in 2023 and is a critical open-source data-transfer library used globally

Connections: Curl · Hackerone · Daniel Stenberg · AI Generated Content · Vulnerability Reporting

Source: https://arstechnica.com/gadgets/2025/05/open-source-project-curl-is-sick-of-users-submitting-ai-slop-vulnerabilities/