AI Is Finding More Software Vulnerabilities Than Humans Can Verify
Starting today, if you report a low or medium severity vulnerability to curl, it does not go to the security team. It goes into a public GitHub issue queue with everything else.
Daniel Stenberg announced the change on October 20. His reason is worth reading closely, because it is not the reason you would guess: “This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in.” Over the last few years, he notes, more than 90% of submissions could quickly be assessed as less than high severity.
Two days later he published something that complicates every story written about AI and open source in the last eighteen months, including mine. “Since spring 2026 the slop reports are practically gone,” he wrote. Recent months have brought hundreds of vulnerability reports and “every single one had AI involved to some extent.” His assessment of them:...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
