Curl creator who called Mythos a “PR stunt” says AI will not take human jobs, but might kill bug bounties

Curl receives a new AI-generated vulnerability report every 18 hours, and most are accurate. That's the problem.

For nearly three decades, Daniel Stenberg has been building Curl, a free and open-source computer program for transferring data to and from internet servers.

What started in 1996 as 100 lines of code has swelled to over 181,000, now has billions of installations, and is a key component of the modern internet.

Stenberg, who recently spoke at the bSides Vilnius conference, said that security around open-source projects is in crisis, thanks to AI that is increasingly used to hunt bugs.

The craft that died

Before 2025, vulnerability research was, what Stenberg calls, an “artisanal era.” Humans were going through the source code line by line and writing custom tools to hunt down security flaws. The best of them turned it into a career as professional bug hunters living entirely off bounty payouts.

The Curl project ran a bug bounty through HackerOne to compensate the researchers for their work.

“It took those skilled people time and effort to hunt for problems, and it took them weeks to find something," Stenberg said.

"It made a lot of sense to offer a bug bounty, because trying to find security problems in software was humans spending a lot of time writing things, investigating, digging, trying, poking, you know?" he added.

Then started what Stenberg calls a “vulnapocalypse.”

People submit AI security reports about things they don’t understand

Sometime around late 2024, Stenberg noticed that the nature of incoming reports had changed. The volume of security reports went up, but the quality cratered.

"Instead of spending all that human time and digging and gripping and writing their own tools, they just asked an AI, 'go find me a problem in Curl,' he said.

The reports started arriving with a clear AI fingerprint. According to Stenberg, it all had the same confident tone, overly polite language, but zero substance.

AI hallucinated APIs and referenced functions that didn't exist in the source code. People were submitting things they simply didn't understand.

It took roughly an hour of maintainer time to debunk a 400-line, completely made-up report. Multiply that by several reports per day, and you start to understand the burnout.

"They ask the AI. The AI said something. They have no idea if it's right or wrong. They just pass it on to us, as if we couldn't ask the AI the same question,"

Stenberg said.

"It got to the level, how do we put an end to this? We can't handle that."

On February 1st, 2026, Stenberg made the decision to pull the plug. Curl abandoned HackerOne and shut down its bug bounty program entirely.

AI is getting better, and that’s a problem

One month later, in March 2026, the Curl project returned to HackerOne. Not because the flood had stopped, because it hadn't. But the water had changed.

The AI models had improved, and the AI slop era was likely over. What replaced it was something Stenberg hadn't anticipated – high-volume, high-quality security reports that are actually technically accurate.

"Something happened. The reports came back, and they did not slow down. They're still really long, but all of the sloppy things, the inventions, the hallucinations are pretty much gone," Stenberg said.

The numbers tell the story with brutal clarity. In the pre-AI era, Curl received roughly one security report per week.

"If you spend an hour or two on those one, 1.5-hour reports per week. That's not a lot of work," Stenberg said.

In 2025, the rate more than doubled to one new report every 48 hours. By early June 2026, it had more than doubled again.

"I think it's 18 hours between every report. So you can see it's more than doubled again from 2025."

More than one report a day. Spending a few hours evaluating each one. For a single maintainer, the math is devastating.

The reports are still pretty much AI-style. They repeat the same facts three times and are excessively and unnecessarily long. Stenberg said he asks bug hunters to explain the problem in five sentences. However, most of them still submit whatever the AI wrote, running to hundreds of lines.

And then there are the duplicates. Previously, it was highly unlikely that two researchers would submit the same bug report.

“It was literally like two people finding needles in the same haystack. And that's never happened,” Stenberg noted.

Now suddenly, Stenberg sees many duplicate reports as researchers ask the same questions, and AI provides the same answers. All this requires evaluation from maintainers and is time-consuming. Not to mention frustrating.

Once a vulnerability is confirmed, writing the fix is usually quicker. It's the evaluation, reading the report, understanding the claim, verifying whether it's real, assessing severity that devours maintainer hours.

AI finds many bugs. Fine, but who’s going to fix them?

AI turns out to be excellent at finding bugs.

"They detect patterns or anomalies, and they find things and poke you in the eye and tell you this is wrong," Stenberg said.

It's not restricted to specific platforms or build systems. It can see into dependencies. It understands network protocols. Achieving the same coverage with human researchers would require enormous capacity.

But finding bugs and understanding their security implications are two different things.

"They're good at finding flaws, not super good at actually assessing the criticality of the problem."

The security reports are easy to generate and hard to process, and they rarely contain fixes.

"The patch ideas are rarely 100%. They're usually a good way to help out, but you still have to have a human involved to actually make the patch fix it," he said.

Even when an AI suggests a solution, it's almost never exactly right.

Another issue is that open source remains chronically understaffed and underfunded. The asymmetry is savage.

"It really just shows that the balance is totally off. It's rather cheap to run a scan and find thousands of issues to work on, but it's really complicated to have your engineering team work on those issues that the scan found for you."

It is also a huge opportunity for threat actors.

"We're going to have all of these projects showing a lot of security vulnerabilities. It's an awesome opportunity for all the bad actors now, because it's going to be an ocean of vulnerabilities to exploit and use and combine," Stenberg warned.

Mythos is a “marketing stunt”

The Mythos model has already earned a near-legendary reputation in the security community. Anthropic restricted Mythos access, claiming it was “too dangerous” to release publicly, but Stenberg is quick to puncture the hype.

In his blog post, he called Mythos an “amazingly successful marketing stunt.” Mythos found one low-severity problem in the Curl code.

"Mythos is a tool. It's a model. It might be really good, but the key here is not the model. The key is the person driving the model and the tooling around it. You can do excellent work with or without this magic model," Stenberg said.

AI-generated code? No one cares if you can explain why

When asked about AI-generated code contributions, Stenberg's position is pragmatic. "My stance is I don't care. I don't care how you make the code. Really, what I care about is that the code is quality. It runs all the test cases," he said.

What he does care about is the communication around it.

"What I'm really getting most frustrated about, actually, when it comes to AI-generated code, is when people then just also paste the explanation from the AI as a motivation why you want to do something.”

“I don't want to read your AI explanation. I want to read your human explanation why you would need that code, and then you can write the code however you want,"

Stenberg said.

The coming period will be brutal for open source maintainers.

"Can you patch fast enough? Because everyone's going to have to upgrade faster, release faster, patch more, and everyone's going to have to help the open-source projects even more to make sure that they can keep on delivering safe and secure stuff, even in this era of tsunamis," Stenberg warned.

But he doesn't believe it means that open source will go extinct.

"It's going to put a lot of pressure on a lot of open source in the short term. And it's going to be a tough period," he said.

"I don't think it's going to be an end or particularly devastating for open source in general, because I think open source actually has this golden opportunity to face and work with this. Because it is open, and everyone can help out."

The question isn't whether AI will keep finding bugs. It will. The question is whether the humans on the other end can keep up.

---

Unlock more exclusive Cybernews content on YouTube.