The curl project has ended its bug bounty program after developers encountered a flood of reports generated by artificial intelligence that are difficult to evaluate.
Last week, Daniel Stenberg, the project lead, posted on GitHub a notice, announcing the program's conclusion by the end of January 2026. He previously expressed dissatisfaction with bug reports from AI in early 2024 and considered closing the program as early as mid-2025. Although he acknowledged that AI could assist in finding bugs, the main issue became the numerous 'useless' reports.
In his message, Stenberg noted that the termination of the bounty program should reduce the influx of low-quality reports and ease the workload for the curl security team.
Stenberg also expressed hope that developers would continue to submit genuine security reports, even without financial rewards.
Source: linux.org.ru
