curl's maintainer: AI vulnerability reports are now accurate, and every recent one involved AI

Stenberg, who maintains curl, writes that "Since spring 2026 the slop reports are practically gone" and that the project's problem is now "high volume, high quality." In the last few months curl has received hundreds of vulnerability reports and, by his account, every one had AI involved to some extent. The reports are typically accurate but very long, and AI still misjudges where a bug ends and a vulnerability begins, and how severe it is. He says reproducers and proofs of concept, once the hard part of reporting, are now often a prompt or two.

He argues the project cannot ignore AI-found reports, partly because some maintainers sell curl support and have contractual obligations to customers. The counts are his own and approximate, and the post gives no breakdown by severity or outcome.

Why it matters: The cost has moved from filtering false reports to triaging real ones at volume. Maintainers and security teams should plan for report length and severity misjudgment, not for hallucinated bugs.