The curl project now receives more than one security report per day — a rate 4-5x higher than 2024 and double the pace from earlier in 2025. The reports are credible, detailed, and largely AI-assisted. And they’re crushing the team.
Daniel Stenberg, curl’s creator and maintainer, laid out the situation plainly:
- Volume: more than one report per day, up from roughly one every four or five days in 2024
- Quality: “way higher than ever before” — reports are long, detailed, and can’t be dismissed at a glance
- Human cost: Stenberg says his wife has voiced concerns about his work hours for the first time in his life
- Priority: every report is high-priority by nature, crowding out all other project work
This isn’t the familiar story of junk AI spam clogging bug bounty queues. The opposite problem is harder. When LLMs produce plausible, well-structured security reports at scale, maintainers can’t batch-reject them. Each one demands real triage — reading, reproducing, assessing severity. For a project embedded in virtually every internet-connected device, ignoring reports isn’t an option the team is willing to take.
Stenberg describes the pressure as “primarily mental” — the team could ignore the flood, but conscience and professional pride won’t let them. That’s the bind. Open-source maintainers already operated on goodwill and unpaid hours. AI tooling just multiplied the demands on that goodwill without adding any capacity on the receiving end.
NOTE
curl is linked into billions of devices and used by nearly every major platform. A real vulnerability in curl is a supply-chain event. That’s why the team can’t afford to deprioritize any credible report.
The core tension: AI makes finding and reporting potential vulnerabilities dramatically cheaper, but triaging them remains expensive human work. Until projects get equivalent AI-assisted triage tooling — or reporting platforms add friction that scales with volume — maintainers like Stenberg absorb the full cost. More than one report a day, no end in sight.