cURL ends bug bounty program amid AI-generated submissions

The popular open-source data transfer tool cURL has terminated its bug bounty program due to an overwhelming influx of AI-generated contributions. Maintainer Daniel Stenberg announced the decision, citing difficulties in assessing the quality and validity of submissions, as reported by The Register.

Stenberg, the lead developer for cURL, stated that the bug bounty program generated seven submissions within the past week, none of which described a security vulnerability. He expressed hope that ending the program would discourage the submission of low-quality or poorly researched reports, whether AI-generated or not. The high volume of submissions placed a significant burden on the cURL security team, and this move aims to reduce noise and focus on genuine security issues. Stenberg encouraged developers to continue reporting actual security vulnerabilities, even without monetary reward.

The decision by cURL highlights a growing challenge for open-source projects in managing AI-assisted contributions. While AI can be a tool for bug discovery, its misuse in generating numerous low-quality reports can strain limited maintainer resources.

Source: The Register