Linux kernel memory-management code reviewer steps down due to influx of AI slop patches — volume of submissions coupled with low manpower forces the step back
But are the vulnerabilities real? The reason the slop submissions are such time sinks is that they look plausible enough to not immediately discard, but they turn out to be non issues under further investigation. This is why Curl no longer has a bug bounty. It was just way to tempting for brain addled “coders” with a Claude subscription to see it as a potentialpassive income stream.
Most of what I hear about these AI bots going through a code base and finding hundreds of bugs is reports from AI boosters of not outright marketing claims from the slop merchants themselves, I wonder why they would want to push a narrative of LLMs fixing Swiss cheese software architecture in minutes 🤔
According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/
However, I doubt that their bug bounty program is ever coming back. As you say, that’ll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
I personally don’t refer to [vulnerability reports created with the help of AIs] as AI slop because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
It’s annoying when the reporter surrender everything to the AI, including the communication part.
The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.
But are the vulnerabilities real? The reason the slop submissions are such time sinks is that they look plausible enough to not immediately discard, but they turn out to be non issues under further investigation. This is why Curl no longer has a bug bounty. It was just way to tempting for brain addled “coders” with a Claude subscription to see it as a potentialpassive income stream.
Most of what I hear about these AI bots going through a code base and finding hundreds of bugs is reports from AI boosters of not outright marketing claims from the slop merchants themselves, I wonder why they would want to push a narrative of LLMs fixing Swiss cheese software architecture in minutes 🤔
According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/
However, I doubt that their bug bounty program is ever coming back. As you say, that’ll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports
That is not what the maintainer of curl said, lmao
This article explains the actual situation.
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.