Person
Swedish software developer who created curl, the widely used data-transfer tool and libcurl library, and has led it as lead maintainer since 1996.
Anthropic's OSS Scanner sends maintainers Mythos findings before its researchers review them, with about 6,000 of 29,000-plus candidates triaged. The service is free and opt-in, and reports carry reproduction steps and proposed fixes where available.
Reality
Curl ended its bug bounty in January 2026 after AI-written reports cut its confirmed rate below 5%, a dev.to post says. The post's own shares and rates explain only a small part of that drop.
Reality
curl 8.23.0 shipped 24 security fixes nine months after the project closed its bug bounty over low-quality reports. The explanation on offer, a human check before each submission, is one auditor's reading.
Reality
Anthropic's Claude flagged more than 29,000 candidate open source vulnerabilities in six months, and upstream projects have patched 516 of them. Maintainers praise the reports, but each fix still ships only as fast as the project that tests and releases it.
Reality
Anthropic expects more than 90% of the unreviewed vulnerability reports its new OSS Scanner sends to open source maintainers to be real. Opt-in projects get findings faster and take on the work of catching the errors, such as wrong severity ratings.
Perspective Coverage
6 publishersReality
Google stopped taking product vulnerability reports for its open-source bug bounty on October 1 after a flood of invalid AI-generated submissions. Any team that takes outside security reports faces the same imbalance, with reports now cheap to write and as costly as ever to check.
Perspective Coverage
15 publishersReality
The case that generated code fails without the usual warning signs comes from two practitioner accounts, while the only measured series is curl's inbound bug reports, and Daniel Stenberg stopped taking those in January 2026.
Reality
JFrog found that 54 of 55 advisories from one new GitHub account were machine-generated fiction. They reached enterprise scanners by the normal route, which is the problem.
Reality