The World's Most Important Open Source Project Just Closed Its Security Inbox — And AI Is to Blame

The phone in your pocket. Your car. Your fridge. The servers your company runs on. Almost all of them ship with a small program called curl — the quiet workhorse that moves data back and forth. It’s installed on more than 10 billion devices. And its creator, Daniel Stenberg, just made a startling announcement: for the entire month of July 2026, curl will stop accepting security vulnerability reports.

One of the most critical pieces of open source software on the planet is shutting its security inbox. What happened? The culprit has a name: AI slop.

What Is AI Slop, Exactly

AI slop is content that an AI generated to look convincing but that turns out to be useless or flat-out wrong. The word “slop” originally means the food scraps you toss to pigs — something that looks like a meal but has no nutritional value. That’s the joke embedded in the term: it has the shape of substance and none of the substance.

In security, slop is especially toxic. Tell a chatbot “find me a vulnerability in the curl source code,” and it will happily produce a report citing functions and line numbers that don’t exist — written in the confident, polished register of a real disclosure. The problem is that it reads like the real thing. The jargon is right. The tone is assured. The formatting is clean.

Fakes That Look Real Are Drowning the Maintainers

Here’s the core of it: an asymmetry in the cost of verification. Generating a fake security report with AI takes seconds. One button press. But the curl maintainer who receives it has to dig through the code, attempt to reproduce the bug, and spend hours determining whether it’s real or garbage.

Stenberg has been sounding this alarm publicly for a while. curl takes vulnerability reports through platforms like HackerOne and pays bounties to people who find genuine bugs. Predictably, bounty-chasers started mass-producing AI-generated reports to game the payouts. A growing share of incoming submissions turned out to be hollow AI output.

And the damage isn’t just wasted time. A real vulnerability report can get buried in the pile of fakes and missed entirely. In security, that’s the nightmare scenario.

Why Pause for a Whole Month

July isn’t an arbitrary choice. curl runs on a handful of volunteers and a small core of developers. There’s no corporate marketing department propping it up. Summer is when people take vacation and staffing thins out — and the team made the pragmatic call that it simply can’t keep triaging an endless flood of fakes during that window.

But this isn’t really a break. It’s a distress flare. Closing the inbox is the team’s way of telling the world the system isn’t functioning right now. For an open source project, shutting down vulnerability intake is a deeply unusual move. That’s how serious things have gotten.

This Isn’t Just curl’s Problem

curl is just the loudest voice in the room. This is a crisis facing the entire open source ecosystem. Maintainers of Python, the Linux kernel, and countless major libraries are describing the same exhaustion. Most of them are unpaid volunteers, and for them, AI slop can be the last straw.

The irony is hard to miss. AI is sold as the tool that writes code faster and hardens security. Yet the junk that same AI produces is wearing down the very people standing on security’s front line. The tool isn’t the villain. The villain is the people firing off output they never bothered to check.

The Takeaway

curl’s decision looks like a small incident, but it lays bare a new kind of burden the AI era has created. When the cost of producing something drops toward zero, the burden on the people who have to verify it doesn’t shrink — it explodes.

So what would you do? Before you submit that AI-generated report, pause once and ask: “Is this actually true?” That small habit of checking might be the most basic act of stewardship there is — the thing that keeps the open source ecosystem we all depend on from collapsing under its own slop.