Open Source Tool cURL Developer Warns: AI Vulnerability Reports Turn to 'High-Quality Chaos', Maintainers Overwhelmed

Daniel Stenberg, developer of open-source network tool cURL, recently posted that AI-generated vulnerability reports have evolved from 'spam' to 'high-quality chaos', putting heavy pressure on open-source maintainers.

Since cURL ended its security bounty program and switched to the Hackerone platform, the number of vulnerability report submissions has increased instead, doubling 2025 levels. In 2026, the interval between reports has dropped below 25 hours, far lower than the 100-hour average from 2020 to 2024. More importantly, the validity rate of reports has rebounded from 5% in early 2025 to 16%, exceeding 2024 levels.

Stenberg warns that AI tools have become standard for vulnerability hunting, and attackers can also use AI to find vulnerabilities quickly. Before maintainers fix the issues, attackers may have already launched attacks, exacerbating the risk of a shorter time gap between vulnerability discovery and exploitation.