OPEN SOURCE PROJECT CURL IS SICK OF USERS SUBMITTING “AI SLOP” VULNERABILITIES

Summary from the TLDR InfoSec newsletter

Daniel Stenberg, the original author of the curl project, posted on LinkedIn about an increasing issue of AI-generated bug reports being submitted to the program on HackerOne. Stenberg has said that maintainers on the project are getting bogged down by “AI slop” reports that include hallucinated vulnerabilities such as one that he cites in the article in which the reported claimed to have found a “novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack” but the reporter continuously gave nonsensical responses to follow-up questions. Stenberg announced that any reporters of “AI slop” vulnerabilities will be banned from the project.