Curl project maintainer Daniel Stenberg says open-source teams can no longer dismiss vulnerability reports simply because artificial intelligence helped produce them. In a new account of curl's security workload, he argues that the project's challenge has shifted from obviously fabricated submissions to a high volume of technically credible, excessively long reports.
Stenberg rejects calls to ignore all AI-assisted material as “slop.” Some reports point to genuine bugs or vulnerabilities, he writes, and discarding a demonstrated flaw because of the tools used to find it would leave users exposed. Curl has no general legal guarantee to fix every defect, but its quality record and the support obligations of contributors who sell curl-related services create strong incentives to investigate credible findings.
The situation differs from earlier waves of AI-generated reports. Stenberg says hallucinated and plainly false submissions have become rare since spring 2026. Over the past several months, curl has received hundreds of vulnerability reports, and he believes every one involved AI to some degree. The current bottleneck is therefore review capacity rather than filtering out obvious nonsense.
Report quality remains uneven in presentation and classification. AI-assisted submissions often run to hundreds of lines, repeat explanations and obscure the core issue that a human reporter could summarize at the beginning. The systems also struggle to distinguish an ordinary software bug from a security vulnerability and to assign an appropriate severity. Stenberg notes that human researchers also make those classification errors, so maintainers still need to perform their own assessment.
One area has improved: reproducing the reported behavior. Recent submissions frequently include effective proof-of-concept programs or reliable steps that trigger the problem. Such evidence helps maintainers determine whether a claim is real, even when the surrounding prose requires heavy triage. Producing reproducers was historically a demanding part of vulnerability research; AI tools can now help reporters generate them more quickly.
The curl experience illustrates an emerging pressure on widely used open-source projects. Automation lowers the cost of searching for possible defects and writing a submission, but it does not supply the trusted human judgment needed to validate impact, establish severity and coordinate a safe repair. That imbalance can direct more useful information toward a maintainer group without expanding the group's time.
Stenberg's response is not an endorsement of every AI tool or every report. It is a practical rule for handling evidence: a reproducible security problem remains relevant regardless of how it was discovered. The harder task for curl is developing a sustainable way to extract concise, actionable findings from a rapidly growing stream of machine-assisted analysis.
