GoKawiilCurl's bug bounty program shuts down amid flood of low-quality AI-generated reports
Curl ended its paid bug bounty program on January 31, 2026, after maintainer Daniel Stenberg said the share of genuine vulnerabilities in submissions dropped from above 15% to below 5% starting in 2025. Over its run, the program had confirmed 87 vulnerabilities and paid out more than $100,000. Google has separately paused supply-chain bounty submissions, though its broader vulnerability rewards programs paid $17.1 million in 2025.
GoKawiil's interpretation of the reporting above, not reported fact.
The pattern suggests AI-generated submissions are straining small security teams' capacity to triage reports, which could push more programs toward stricter verification requirements or narrower scopes. For newcomers to bug hunting, this implies that producing verifiable, well-documented findings may matter more than ever, even as some entry points shrink. The continued scale of Google's payouts shows opportunity persists, but likely under tighter scrutiny.
- Curl closed its paid bounty program after verified vulnerability rates fell from over 15% to under 5% since 2025.
- Curl's program had paid over $100,000 for 87 confirmed vulnerabilities across its lifetime.
- Google paused only supply-chain bounty submissions while still paying $17.1 million through its wider programs in 2025.
No Starch Press: The Web Application Hacker's Handbook — If you're starting out in bug bounty hunting, building a solid foundation in manual vulnerability analysis is far more valuable than relying on AI-generated reports. This classic guide walks through real methodology for finding and verifying web vulnerabilities, exactly the kind of rigor that keeps your submissions credible to overworked security teams. It's a great companion as you move from theory to practical, verifiable bug hunting.
See No Starch Press: The Web Application Hacker's Handbook on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-31
Published there as: “From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.