cURL Maintainer Ends Bug Bounty Payouts Over AI Spam

The maintainer of cURL, a widely known utility found in nearly every Linux distribution as well as in macOS and Windows, has announced the end of the Bug Bounty program that had run since 2019. The reason is simple and telling: the development team could not keep up with the flood of useless bug reports generated by artificial intelligence and submitted by bounty hunters.

A Bug Bounty program, or reward program for discovered bugs, is a common practice in open-source software development. It lets projects bring in outside security researchers to look for vulnerabilities in the code, and those researchers receive a cash reward. It benefits developers, who get a chance to improve the security of their product, and researchers, who can earn money from their expertise.

In cURL's case, however, the situation got out of hand. As artificial intelligence advanced, it became possible to automate the search for vulnerabilities. Unscrupulous participants in the Bug Bounty program began using AI to generate huge numbers of bug reports, most of which turned out to be false or insignificant. Reviewing these reports consumed an enormous amount of the cURL team's time and resources, making the Bug Bounty program unsustainable.

The case raises important questions about the future of Bug Bounty programs in the age of artificial intelligence. On the one hand, AI can be a useful tool for automating vulnerability discovery and making security researchers more efficient. On the other, it can also be abused, as happened with cURL. Developers need to adapt their Bug Bounty programs to the new reality to prevent similar situations. It may be necessary to introduce stricter criteria for selecting bug reports and to use in-house AI tools to filter out false positives.

Ending the Bug Bounty program for cURL may have negative consequences for the security of the utility. Fewer independent security researchers hunting for vulnerabilities may mean that some serious bugs go unnoticed. Ultimately, this may raise the risk of attacks on systems that use cURL.

The incident shows that the development of AI creates new challenges for the information security industry. Developers need to be ready for these challenges and adapt their working methods so they can use AI's capabilities effectively and protect themselves from its potential threats. Otherwise, we may face a situation in which AI, instead of improving security, helps erode it.