What happened
In January 2026 Daniel Stenberg announced that cURL's bug bounty on HackerOne would close on 1 February — after six years and $86,000 in payouts (The Register). The reason: an avalanche of "AI slop" — plausibly written LLM reports about nonexistent vulnerabilities, code paths cURL does not have, and long-patched CVEs.
By mid-2025 such submissions already made up 20% of the flow, and the share of valid ones had dropped to roughly 5%; in the first weeks of 2026 alone the team counted twenty junk submissions (BleepingComputer). "The point of shutting it down is to remove the incentive to send garbage," Stenberg wrote: vulnerabilities are now accepted only through GitHub Security Advisories, with no rewards (daniel.haxx.se).
Why it matters
Open-source infrastructure has come under a peculiar kind of AI DDoS: not traffic, but cognitive load on maintainers. Ghostty and tldraw have reported similar problems. Money meant to attract researchers started attracting noise generators instead — and the economics of crowdsourced security broke.
What it means for vibe coding
The direct lesson: don't send AI-found "vulnerabilities" without manual verification — you're not helping, you're doing harm. If you use agents for security research, report only what you reproduced yourself: PoC, steps, versions. Otherwise your report is part of the problem that gets bounties shut down.