Daniel Stenberg
Founder and Lead Developer of curl
Creator of curl, the transfer tool running in some twenty billion installations. Buried under fabricated “AI slop” vulnerability reports, he instituted instant bans, declared the project “effectively being DDoSed,” and shut down curl’s bug bounty entirely in 2026.
In his words
We now ban every reporter INSTANTLY who submits reports we deem AI slop. A threshold has been reached. We are effectively being DDoSed. If we could, we would charge them for this waste of our time.
That’s it. I’ve had it. I’m putting my foot down on this craziness.
You should NEVER report a bug or a vulnerability unless you actually understand it – and can reproduce it.
Biography
Daniel Stenberg (born 1970) is the Swedish engineer behind curl, the data-transfer tool and library he has led since 1998. Running in an estimated twenty billion installations — every phone, car, TV, and server touches it — curl may be the most widely deployed software component on Earth, and Stenberg its famously tireless steward, winner of Sweden’s Polhem Prize for the work.
The frontline of the slop wars
Curl became the canary for a new open-source pathology: confident, fabricated vulnerability reports generated by LLMs and lobbed at bug bounties in hope of a payout. In May 2025 Stenberg announced instant bans for anyone submitting “AI slop” to curl’s HackerOne program, likening the flood to a denial-of-service attack on his security team. The numbers backed him: where roughly one in six reports had once been valid, by late 2025 it was closer to one in twenty or thirty.
In January 2026 he took the step he had long resisted and ended curl’s bug bounty — which had paid out over $100,000 for real findings — to “remove the incentive for people to submit crap and non-well researched reports to us. AI generated or not.” The move made headlines across the industry as the clearest casualty yet of AI-generated noise in security research.
Stenberg’s position is more precise than blanket rejection: he calls AI a tool and has praised what skilled humans do with it — when researcher Joshua Rogers used AI-assisted scanning to surface dozens of genuine curl bugs in late 2025, Stenberg landed the fixes and called them “actually truly awesome findings.” His war is against unreviewed machine output wasting scarce maintainer attention — a fight he shares with Andrew Kelley and other open-source leaders, even as Linus Torvalds pushes the other way on AI in the kernel.
Where they stand in the war
Who backs them up
Sources & further reading
Canonical record: https://battlelines.ai/topic/daniel-stenberg