In July 2025, a man who maintains software that runs on billions of devices opened his bug bounty inbox and found seven security reports filed inside sixteen hours. He read every one. Not a single one described a real bug.
His name is Daniel Stenberg, he runs curl, and his security team is seven volunteers. Every report read as confident and precise, down to the function names and the vulnerability class it cited. All of it was a chatbot’s guess dressed up as a discovery, and each one took a human far longer to disprove than the machine took to write. Stenberg gave the pattern a name. Death by a thousand slops.
Look at what that did to the signal. For years, north of fifteen percent of the reports curl received turned out to be real, a strong rate for a codebase this picked-over. Through 2025 it fell below five percent. Not even one in twenty was real. In January 2026 Stenberg shut the whole programme down to kill the incentive.
Apple met the same flood and tried a different fix, a cap on how many reports a single researcher can file. A small team in Milan had used an AI tool to find a real way to take over any Mac, the kind of bug Apple pays up to two hundred thousand dollars for. They hit the cap before they could report it. The net built to catch the slop caught the one person who found something real.
That is the trap the flood sets. Send good work and the noise buries you while the filters lock you out. Sit where the reports land and you drown.
So here is the mistake the whole thing is built on, and the way out of it. Most of the people filing this stuff never ran the bug. They asked a model to find a critical flaw in someone else’s code, and they forwarded the answer. The model always answers. It does not know whether the bug is real, and neither do they.
I spent years on the other side of that inbox, sorting real reports from noise, and you learn to tell them apart in minutes. A slop report explains an exploit. A real report proves one. The slop names a reentrancy bug in a withdraw function and writes it up in fluent prose. The real one hands you a Foundry test that forks mainnet, fires the exploit, and drains the pool in front of you when you run it.
That is the whole game, and it has nothing to do with whether you used AI. Use the model. Point it at the code, let it read faster than you can, let it flag the paths worth a look. Then do the part it cannot. Reproduce the bug on your own machine. Build the exploit that fires it. If it does not fire, it does not go in the report.
The asymmetry is what makes that rule non-negotiable. A slop report costs the sender thirty seconds and a prompt. It costs the person reading it hours, and there are seven of them and thousands of you. Send one unverified guess and you have not contributed anything. You have stolen time from the people who fix the thing you claim to care about.
The slop did not win. Through 2025 the models hallucinated bugs, and by early 2026 they had all but stopped. curl’s confirmed rate climbed back toward fifteen percent, and across HackerOne the count of valid AI-found vulnerabilities more than tripled in a single year. The tool works. It was never the problem.
The flood changed shape instead. In May 2026 Linus Torvalds called the Linux kernel’s security list almost entirely unmanageable, and this time the bugs were real. Real bugs kept arriving in duplicate, because everyone points the same tools at the same code and nobody can see what has already come in. Each reporter thinks they are first. The kernel’s answer, written straight into its rules, is the whole of this argument. Include a verified reproducer. Report what you can reproduce and understand, or do not report it at all.
That is the line that now splits the field. On one side sit the researchers who verify before they send, whose reports get opened first and whose names a triager learns to trust. On the other sit the sprayers, whose reports get binned on sight and whose accounts get banned.
The tools are only getting sharper from here. AI will find more bugs; be sure to learn how to prove them.
— Adrian