Open source projects have to check every private security report before they can do anything else. I wanted to know whether AI-written reports have genuinely moved work from senders to receivers, and what projects have done about it.
curl ended its cash bug bounty in January 2026. Its maintainers said the share of reports that turned out to be real fell from above 15% to below 5%, and blamed AI-generated slop, poorer reports in general, and the pull of reward money. Django, Python, Node.js, Apache Log4j, the Linux kernel, FFmpeg, Google's open source reward programme and HackerOne's Internet Bug Bounty have all published complaints or changed their rules: cutting rewards, limiting who may report, requiring disclosure of AI use, or treating AI-found bugs as public.
The other side is stronger than the complaint usually allows. Researchers who checked their AI-assisted findings gave curl hundreds of accepted fixes. An AI security firm is credited with 22 of the 52 flaws OpenSSL published between September 2025 and August 2026, though the trend inside that is worth seeing: all twelve in January, two of eighteen in June, none in August. HackerOne says its valid-report share held steady while volume rose. curl describes itself as worse hit than similar projects and partly blames its own cash rewards, and a senior kernel maintainer said in March 2026 that the kernel could cope while asking for help for other projects.
So it depends what you mean. The complaint holds for unchecked AI output sent in chasing rewards. It doesn't hold as a judgement on AI-assisted security research, which has produced real results. And during 2026 a different problem appeared that isn't about slop at all: a flood of mostly correct, minor, duplicated reports that volunteers can't fix fast enough. Nearly all these figures come from maintainers counting their own reports, and nobody has measured time spent per report, which is the number that would settle it.