--- title: AI Has Broken Open Source | daily.dev description: AI is reshaping open source from both ends: users can customize software more easily than ever, but maintainers face floods of AI-generated PRs, hallucinated... canonical: https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI Has Broken Open Source | daily.dev og:description: AI is reshaping open source from both ends: users can customize software more easily than ever, but maintainers face floods of AI-generated PRs, hallucinated... og:url: https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0 og:image: https://api.daily.dev/og/posts/KkCs2V2e0.png og:image:alt: AI Has Broken Open Source og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI Has Broken Open Source **[ForrestKnight](https://daily.dev/sources/fknight)** · 25 min read · 12 upvotes · 4 comments ## Summary AI is reshaping open source from both ends: users can customize software more easily than ever, but maintainers face floods of AI-generated PRs, hallucinated vulnerability reports, and license-laundering attempts. Curl's Daniel Stenberg shut down its bug bounty program in January after accuracy dropped from 15% to below 5%, only to later reinstate it via HackerOne once report quality improved. Hacker One paused its internet bug bounty program after submissions nearly doubled with mostly bad reports. Cal.com went closed-source citing exploitation risk. The Linux kernel now sees double the daily security reports it used to get weekly, though Linus Torvalds still rejects an anti-AI stance, backing the Sashiko AI code-review bot instead. Codeberg's members voted to ban mostly-AI-written projects. Different projects are experimenting with solutions: vouch-based contributor gatekeeping (Ghostty), heavy CI pipelines (Curl, Bun), and AI-assisted code review, with no universal fix in sight. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did curl shut down its bug bounty program in January 2026? Daniel Stenberg shut down curl's bug bounty program because AI-generated vulnerability reports flooded the system with false positives, dropping the accuracy rate from 15% to below 5%. Over six years the program had found 87 real vulnerabilities and paid out over $100,000, but AI let anyone generate a fake report in minutes while still taking Stenberg one to two hours to review each one, so he ended monetary rewards to remove the incentive for fabricated submissions. _Maintainers weighing bug bounty tradeoffs can follow how curl and others responded to AI report floods on daily.dev._ ### Did curl bring back its bug bounty program after shutting it down? Yes, curl moved reports to GitHub temporarily, then returned to HackerOne without offering monetary rewards. Reports kept coming in, even more than before, but the accuracy rate climbed back above 15%, suggesting the quality of AI-assisted submissions has improved even though the volume remains high compared to earlier years. _Track how AI is reshaping security reporting workflows for open source projects on daily.dev._ ### Why did the Linux kernel security team say AI-generated reports became unmanageable? The Linux kernel's private security list went from receiving two to three reports a week to more than double that volume in a single day, according to Linus Torvalds, who called it unmanageable. This occurred despite 80-90% of kernel contributions coming from salaried employees at companies like Intel and Microsoft rather than volunteer contributors, yet Torvalds still refused to ban AI-assisted code, requiring only human review and contributor accountability. _Developers deciding how to handle AI contribution policy can compare kernel-level approaches on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@fbritoferreira** · 4 upvotes > Is something open source will need to figure out in the year to come **@cevheri** · 0 upvotes > Code review has become more difficult, I agree; but I can't understand the policy of package managers like @flathub not to accept code developed with Gen-AI. Do FlatHub developers not use things like Claude, Cursor, Codex, OpenCode, Hermes, DeepSeek Harness? Or are their teams using them secretly? I don't know when this paradox will be resolved. ## Similar posts on daily.dev - [AI is destroying Open Source, and it's not even good yet](https://daily.dev/posts/ai-is-destroying-open-source-and-it-s-not-even-good-yet-p4vqhmmfm) · Jeff Geerling · 4 upvotes · 1 comments - [Is AI Overwhelming Open Source?](https://daily.dev/posts/is-ai-overwhelming-open-source--xablcfvg9) · Telerik · 0 upvotes · 0 comments - [Cal.com Goes Close Source Because "AI Can Easily Exploit Open Source Software"](https://daily.dev/posts/cal-com-goes-close-source-because-ai-can-easily-exploit-open-source-software--onylkwl5j) · It's Foss · 0 upvotes · 0 comments - [Enterprise use of open source AI coding is changing the ROI calculation](https://daily.dev/posts/enterprise-use-of-open-source-ai-coding-is-changing-the-roi-calculation-ixa8rnxuv) · InfoWorld · 3 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#ai-coding](https://daily.dev/tags/ai-coding), [#curl](https://daily.dev/tags/curl) [View this post on daily.dev](https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI Has Broken Open Source","url":"https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0"},"datePublished":"2026-08-17T19:32:36.565Z","dateModified":"2026-09-14T08:57:22.038Z","description":"AI is reshaping open source from both ends: users can customize software more easily than ever, but maintainers face floods of AI-generated PRs, hallucinated...","image":"https://i.ytimg.com/vi/qazhWj8kYLo/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/qazhWj8kYLo/sddefault.jpg","isAccessibleForFree":true,"articleSection":"ForrestKnight","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ForrestKnight","logo":"https://media.daily.dev/image/upload/s--dRXNb2_3--/f_auto/v1745508651/logos/fknight","url":"https://daily.dev/sources/fknight"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":12},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"open-source,ai-coding,curl","timeRequired":"PT25M","video":{"@type":"VideoObject","name":"AI Has Broken Open Source","description":"AI is reshaping open source from both ends: users can customize software more easily than ever, but maintainers face floods of AI-generated PRs, hallucinated...","thumbnailUrl":"https://i.ytimg.com/vi/qazhWj8kYLo/sddefault.jpg","uploadDate":"2026-08-17T19:32:36.565Z","duration":"PT25M","url":"https://api.daily.dev/r/KkCs2V2e0","embedUrl":"https://www.youtube.com/embed/qazhWj8kYLo"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ForrestKnight","item":"https://daily.dev/sources/fknight"},{"@type":"ListItem","position":3,"name":"AI Has Broken Open Source"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0","comment":[{"@type":"Comment","text":"Is something open source will need to figure out in the year to come","datePublished":"2026-08-18T04:36:31.806Z","url":"https://daily.dev/posts/KkCs2V2e0#c-b4EqfdBTo","author":{"@type":"Person","name":"Filipe Brito Ferreira","url":"https://daily.dev/fbritoferreira","image":"https://media.daily.dev/image/upload/s--juR-VHvv--/f_auto/v1787057496/avatars/avatar_iapbjEhwJFmwEiaBLnyPw?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Code review has become more difficult, I agree; but I can’t understand the policy of package managers like @flathub not to accept code developed with Gen-AI. Do FlatHub developers not use things like Claude, Cursor, Codex, OpenCode, Hermes, DeepSeek Harness? Or are their teams using them secretly? I don’t know when this paradox will be resolved.","datePublished":"2026-08-24T20:01:58.114Z","url":"https://daily.dev/posts/KkCs2V2e0#c-wawzJJSCw","author":{"@type":"Person","name":"cevheri","url":"https://daily.dev/cevheri","image":"https://avatars.githubusercontent.com/u/12383547?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-has-broken-open-source-kkcs2v2e0#faq","mainEntity":[{"@type":"Question","name":"Why did curl shut down its bug bounty program in January 2026?","acceptedAnswer":{"@type":"Answer","text":"Daniel Stenberg shut down curl's bug bounty program because AI-generated vulnerability reports flooded the system with false positives, dropping the accuracy rate from 15% to below 5%. Over six years the program had found 87 real vulnerabilities and paid out over $100,000, but AI let anyone generate a fake report in minutes while still taking Stenberg one to two hours to review each one, so he ended monetary rewards to remove the incentive for fabricated submissions. Maintainers weighing bug bounty tradeoffs can follow how curl and others responded to AI report floods on daily.dev."}},{"@type":"Question","name":"Did curl bring back its bug bounty program after shutting it down?","acceptedAnswer":{"@type":"Answer","text":"Yes, curl moved reports to GitHub temporarily, then returned to HackerOne without offering monetary rewards. Reports kept coming in, even more than before, but the accuracy rate climbed back above 15%, suggesting the quality of AI-assisted submissions has improved even though the volume remains high compared to earlier years. Track how AI is reshaping security reporting workflows for open source projects on daily.dev."}},{"@type":"Question","name":"Why did the Linux kernel security team say AI-generated reports became unmanageable?","acceptedAnswer":{"@type":"Answer","text":"The Linux kernel's private security list went from receiving two to three reports a week to more than double that volume in a single day, according to Linus Torvalds, who called it unmanageable. This occurred despite 80-90% of kernel contributions coming from salaried employees at companies like Intel and Microsoft rather than volunteer contributors, yet Torvalds still refused to ban AI-assisted code, requiring only human review and contributor accountability. Developers deciding how to handle AI contribution policy can compare kernel-level approaches on daily.dev."}}]} ```