PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacker opinion piece: How lazy hacking killed cURL’s bug bounty

bugcrowd.com | blog | #ai-security | #bug-bounty | #zero-day | #open-source | #vulnerability-disclosure | #ai-slop | #curl | #daniel-stenberg | #false-reports
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

cURL ended its six-year bug bounty after a flood of AI slop reports: 20 submissions in early 2026 yielded zero valid bugs, so Daniel Stenberg moved reports to GitHub with no bounties.
Published
Collected

Related coverage

blog · bugcrowd.com
The hidden cost of agentic pentesting
Bugcrowd finds agentic pentesting tools submit overwhelmingly low-signal reports on public bug bounty programs, while top findings still come from skilled humans; triage absorbs the hidden cost.
blog · bugcrowd.com
The AI slop era: Do most vulnerabilities actually matter?
A Bugcrowd panel on the 'AI slop' era: after filtering hallucinated reports, AI-assisted discovery still yields 10x more valid findings than teams can fix, so context must drive prioritization.
blog · bugcrowd.com
What verified users say about running a vulnerability disclosure program with Bugcrowd
A VDP is only as effective as its process: structured intake, expert triage filtering duplicates and AI slop, and Jira or Slack integrations keep vulnerability reports flowing to resolution.
blog · bugcrowd.com
Continuing our work to reduce AI slop submissions and protect signal quality
Bugcrowd outlines four changes against sloptimism: bans for submission farming, mandatory identity verification, throttling for low performers, and CAPTCHA validation before submitting.
blog · bugcrowd.com
Sloptimism is breaking any system built on human validation
A 334% triage-queue spike traced to sloptimism — AI reports trusted over evidence. The same failure mode strains open source and academia, where faking is cheap but verifying is not.
blog · bugcrowd.com
Three common hacker mistakes to avoid
Amid AI slop straining triage, hackers are urged to read briefs carefully, treat unlisted assets as out of scope, and polish in-scope reports with detailed reproduction steps and clear impact.
Back