AI-Generated Bug Reports Overwhelm Security Databases, Leading Major Open-Source Projects to Shut Down Vulnerability Programs

A flood of low-quality, AI-generated vulnerability reports has forced curl, one of the world's most widely deployed open-source projects, to shut down its bug bounty program, exposing a critical crisis in the infrastructure that manages software security worldwide. Effective February 1, 2026, curl ended its six-year partnership with HackerOne, the leading bug bounty platform, after the share of confirmed vulnerabilities plummeted from 15% to just 5% as autonomous AI agents began mass-submitting reports that read convincingly but describe bugs that do not exist.