In January 2026, curl maintainer Daniel Stenberg shut down curl's long-running bug bounty program. curl is one of the most widely deployed pieces of software on the planet — this wasn't a project short on attention. The reason was volume: AI-generated vulnerability reports had pushed submissions to roughly 8x normal levels, with an estimated 20% of them citing vulnerabilities that don't exist in the codebase at all. Stenberg's own summary was blunt: the team was spending more time debunking reports than fixing real bugs.
"No reliable technical indicator... detection is often based on vibes." — a maintainer describing the state of AI-slop report triage in 2026
curl is just the highest-profile project to say the quiet part out loud. The same pattern shows up across the industry: HackerOne now estimates 60-80% of submissions across its entire platform are invalid. Bugcrowd's triage queues grew over 300% in a few weeks in 2026, almost entirely from low-quality AI-generated submissions researchers refer to as "sloptimism" — reports optimistically generated by a model with no verification that anything in them is real.
Coding-capable LLMs made it trivial to generate a plausible-looking vulnerability report: correct terminology, a CVE-style structure, a severity rating, a "proof of concept." What they don't reliably do is verify the claim against the actual current state of the target repository — the file really exists, the line number is really inside it, the function is really there. A model optimizing for a report that reads like a real vulnerability report will happily generate one that cites a file that doesn't exist, because nothing in the generation process checks.
HackerOne built "agentic validation" into its managed platform. GitHub restructured its bounty program around an invite-only tier. Both are real responses — and both are out of reach for the overwhelming majority of open-source maintainers and small teams running their own security@ inbox or GitHub Security Advisories process without an enterprise HackerOne or Bugcrowd contract. Nothing self-serve exists for them.
The fix for AI-generated false claims isn't a smarter model reading the report — that's still a judgment call, still "vibes." The fix is checking the report's concrete, falsifiable claims against the real repo: does this file exist, is this line inside it, does this function appear anywhere in it. That's deterministic. A file either exists at that path or it doesn't.
TriageShield does exactly that — paste a report and a GitHub repo URL and it runs those checks against the repo's real, current state in seconds, for free, no signup, on any public repo. It won't catch a well-written fabrication with no concrete pointers, and it says so plainly rather than guessing. But it clears the lazy, mass-produced fakes — the ones that are most of curl's 8x volume spike — instantly.
Check a report against a real repo, free →