AI-Generated Bug Reports Overwhelm cURL Maintenance Team

Gate News message, April 18 — Daniel Stenberg, maintainer of cURL, said AI-generated bug reports are significantly increasing the workload for the open-source data transfer tool. In 2025, cURL received 181 bug or security reports, with 87 additional reports submitted by April 9, 2026, putting the project on track to receive roughly as many reports in 2026 as it did during the entire 2020–2023 period.

The cURL project has a team of six volunteer maintainers, with Stenberg as the only full-time member. Each bug fix takes approximately two hours on average, meaning the surge in reports is straining limited resources significantly.

Anthropicresponded by limiting access to its Mythos model—which can find and exploit zero-day flaws—to approximately 40 organizations, while pledging $4 million to software maintainer groups. The model has demonstrated the ability to discover vulnerabilities that survived decades of human security reviews and automated testing.

Google has paused its open-source vulnerability reward program, and the Internet Bug Bounty program has suspended new submissions as AI tools continue to increase report volumes across the industry.