curl ended its bug bounty at the end of January 2026 because a flood of AI-generated reports was overloading its security team.

What this evidence bears on

• Supports: Many AI reports are low-value, so a fixed clock forces volunteers to spend scarce time on bugs that barely matter.

  • A reason for “Give maintainers more time”