> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# cURL Gets Rid of Its Bug Bounty Program Over AI Slop Overrun
- URL: https://itsfoss.com/news/curl-closes-bug-bounty-program/
- Published: 2026-01-23T19:55:07.000Z
- Updated: 2026-01-23T19:55:07.000Z
- Description: Daniel Stenberg says the inflow of AI slop has become unsustainable for the curl security team to handle.
- Author: Sourav Rudra
- Tags: News

Last year in May, the [cURL](https://curl.se/?ref=itsfoss.com) project's bug bounty program [was inundated with AI slop](https://itsfoss.com/news/curl-ai-slop/), where many bogus reports were opened on [HackerOne](https://hackerone.com/curl?ref=itsfoss.com), leaving the cURL maintainers to go through garbage.

The problem didn't stop even after [Daniel Stenberg](https://www.linkedin.com/in/danielstenberg/?ref=itsfoss.com), the creator of cURL, threatened to ban anyone whose bug report was found to be [AI slop](https://en.wikipedia.org/wiki/AI%5Fslop?ref=itsfoss.com). We are now in 2026, and the situation has reached a tipping point.

📋

For context, cURL is an open source command-line tool used by billions of devices worldwide.

## cURL Says Enough is Enough

![this picture shows a ascii-based notice on curl's website announcing that they dont provide any rewards or any kind of compensation for reported problems, basically notifying that their bug bounty program is no more](https://itsfoss.com/content/images/2026/01/curl-bug-bounty-program-notice.png)

**The* [**notice*](https://curl.se/.well-known/security.txt?ref=itsfoss.com) *for your perusal.*

Daniel has submitted [a pull request](https://github.com/curl/curl/pull/20312?ref=itsfoss.com) on GitHub that removes all mentions of the bug bounty program from cURL's documentation and website. Coinciding with that, the project's [security.txt](https://curl.se/.well-known/security.txt?ref=itsfoss.com) file has been updated with some blunt language that makes the new policy crystal clear.

The cURL team intends to make a proper announcement in the coming days, though many outlets have already covered the news of this happening, *so I would say they ought to get on it ASAP!* 😆

The program **officially ends in a few days on January 31, 2026**. After that, security researchers can still report issues through [GitHub](https://github.com/curl/curl?ref=itsfoss.com) or the project's [mailing list](https://curl.se/mail/?ref=itsfoss.com), **but there won't be any cash involved**.

What pushed them over the edge?, you ask. Well, just weeks into 2026, **seven HackerOne reports came in within a 16-hour period** in just one week. Some were actual bugs, but none of them were security vulnerabilities. By the time Daniel posted his [recent weekly report](https://lists.haxx.se/pipermail/daniel/2026-January/000143.html?ref=itsfoss.com), they'd already dealt with 20 submissions in 2026.

The main goal here is said to be stopping the flood of garbage reports. By eliminating the money incentive, they are hoping people (*or bots?*) will stop wasting the security team's time with half-baked, unresearched submissions.

He also gives a stern warning to wannabe AI sloppers, saying that:

> This is a balance of course, but I also continue to believe that exposing, discussing and ridiculing the ones who waste our time is one of the better ways to get the message through: you should NEVER report a bug or a vulnerability unless you actually understand it - and can reproduce it. If you still do, I believe I am in the right to make fun of - and be angry at - the person doing it.

So, yeah, that's that. **If people still don't understand that AI slop is harmful** to such sensitive pieces of software, then sure, they can go ahead and make a fool of themselves.

---

**Suggested Read 📖:** [*Open Source Project LLVM Says Yes to AI-Generated Code*](https://itsfoss.com/news/llvm-ai-policy/)

[Open Source Project LLVM Says Yes to AI-Generated Code, But Not Without ConditionsThe new “human in the loop” policy holds contributors accountable for reviewing and understanding all AI-assisted submissions.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-236.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/llvm-new-ai-policy-banner.png)](https://itsfoss.com/news/llvm-ai-policy/)