Curl Ends HackerOne Bug Bounty Amid Flood of AI-Generated Reports

The widely used curl command-line tool and its companion library libcurl are changing the way they handle security vulnerability reports. In a major announcement, the curl project revealed that it will end its HackerOne bug bounty program at the end of January 2026, citing an overwhelming number of low-quality, AI-generated vulnerability submissions. This marks a significant shift for a project that has long incentivized responsible reporting of security flaws with monetary rewards.

Curl, a cornerstone utility for transferring data across various protocols, has been a favorite among developers for connecting to websites and integrating file transfer capabilities into applications. Since 2019, its bug bounty program, run through HackerOne and the Internet Bug Bounty, offered cash rewards for responsibly disclosed vulnerabilities in both curl and libcurl. However, according to Daniel Stenberg, curl’s founder, the program has recently been flooded with poorly researched and largely automated submissions, putting a heavy strain on the small team of maintainers.

Stenberg described the problem as a surge of “AI slop”—low-effort, AI-generated reports that look plausible but are essentially useless. In one instance, the security team received seven HackerOne reports within 16 hours, none of which identified a valid vulnerability. By January 2026, twenty such submissions had already been processed, consuming disproportionate time and resources.

The upcoming change is documented in a pending update to curl’s BUG-BOUNTY.md file, which will remove all references to HackerOne. Moving forward, curl will no longer provide monetary rewards for reported bugs, nor will it assist researchers in obtaining compensation from other sources. The project will shift to a direct GitHub-based reporting system starting February 1, 2026, while continuing to process any pending HackerOne submissions until the end of January.

Curl’s security.txt file also reflects the new stance, warning that “crap” submissions may result in public ridicule or bans. Stenberg emphasized that while the change may not completely stop low-quality reports, it is necessary to protect the mental health of maintainers and ensure the sustainability of the project. He also hinted at a detailed blog post to follow, explaining these updates and providing guidance for researchers on proper reporting.

What Undercode Say:

The curl project’s decision highlights a growing challenge for open-source security programs in the age of AI-assisted submissions. As AI tools become more accessible, automated scripts can generate thousands of superficially plausible bug reports in minutes, overloading maintainers and reducing signal-to-noise ratios in bug bounty programs. Small projects like curl, which rely on a handful of active developers, are particularly vulnerable to this “report fatigue.”

Switching from HackerOne to an internal submission process represents a strategic pivot. By removing financial incentives, curl is attempting to filter out low-effort submissions and focus on reports that truly enhance software security. This may set a precedent for other open-source projects facing similar pressures. Larger projects with dedicated security teams may absorb the AI slop, but smaller teams will increasingly need manual or automated triaging strategies.

This move also underscores the tension between open-source transparency and maintainers’ workload. While bug bounty programs encourage responsible disclosure, they also attract opportunistic or automated actors seeking quick rewards. The curl example illustrates that monetary incentives can sometimes backfire if not carefully managed.

Developers and researchers looking to contribute to curl must now adjust to direct GitHub reporting, which emphasizes quality over quantity. AI-generated tools may still assist security research, but careful human validation remains critical. Curl’s decision may also accelerate discussions on AI-aware bug bounty systems, where automated reports are filtered before reaching human reviewers.

Curl’s founder candidly acknowledged the psychological toll of handling meaningless submissions—a reminder that open-source maintainers are finite resources. Protecting mental health and project sustainability may soon become a key consideration in security program design, alongside traditional metrics like bug discovery rates or financial rewards.

Overall, curl’s shift could spark wider reevaluations in the open-source ecosystem, balancing security incentives, developer workload, and AI-driven disruptions.

Fact Checker Results:

✅ Curl is ending HackerOne bug bounty at the end of January 2026 – confirmed by pending BUG-BOUNTY.md update.
✅ Shift to direct GitHub reporting starting February 1, 2026 – verified in curl’s security.txt and developer statements.
✅ Reason for termination: surge of low-quality AI-generated reports – confirmed by statements from Daniel Stenberg.

Prediction:

💡 Other small and mid-sized open-source projects may follow curl’s lead, reducing or restructuring bug bounty programs.
💡 Expect AI-aware triage systems to emerge, automating preliminary filtering of low-quality submissions.
💡 Security communities may push for standardized guidelines on AI-assisted vulnerability reporting to maintain quality and protect maintainers.

If you want, I can also turn this into a fully formatted 1,500+ word article with richer storytelling, examples of AI slop, and visual analogies that will feel like a tech feature in Wired or The Verge. Do you want me to do that next?