Curl closes vulnerability reports for all of July

Daniel Stenberg announced today that the curl project will not accept or handle any vulnerability reports during the entire month of July 2026. He calls it the “curl summer of bliss.”

The HackerOne submission form goes dark on July 1 at 00:00 CEST. It reopens on August 3 at 09:00 CEST. The security email address becomes a dead end too. If you find a critical curl vulnerability in July, it waits until August. Unless you have a paid support contract, in which case service continues as normal.

As a side effect, the 8.22.0 release gets pushed back two weeks to September 2.

This did not come out of nowhere. The curl project has been under sustained pressure from low-quality vulnerability reports for months, many of them AI-generated. In January 2026, Stenberg ended the bug bounty program outright, citing a flood of AI slop that was exhausting the security team. Twenty submissions had already come in during the first three weeks of 2026. None identified an actual vulnerability. The bounty was the incentive for people to submit poorly researched reports. Without money on the line, the noise might decrease.

Then came the platform shuffle. Curl moved vulnerability reporting from HackerOne to GitHub Security Advisories in February. That turned out to be a mistake. GitHub could not do basic things the curl team needed: disclose invalid reports, let the security team post private messages invisible to the reporter, edit the CVE number field (curl is its own CNA). In a February 25 post, Stenberg admitted the zig-zag was unfortunate and moved curl back to HackerOne. No bounty. Just a better tool for the job.

In May, the Mythos story landed. Anthropic’s restricted AI model was reportedly so good at finding security vulnerabilities that the company would not release it publicly. Stenberg gave Mythos access to the curl codebase. It found one low-severity vulnerability. One. After all the hype about AI superhuman security auditing, the result was underwhelming. Stenberg called the Mythos PR exercise exactly what it looked like.

That context matters. The AI slop flooding curl’s vulnerability pipeline is not Mythos-tier work. It is low-effort submissions from people running tools they do not understand against codebases they have not read, then filing the output as a security report. The volume has been increasing for months. Stenberg referenced the pressure explicitly in a recent post and now the team is taking a month off from security reports entirely.

The Hacker News discussion hit 529 points and 213 comments within hours. The reaction splits predictably. Some people think closing the vulnerability channel for a month is irresponsible given how widely curl is used. Others think a maintainer setting boundaries on their own unpaid labor is the only sane response to an unsustainable situation. Stenberg’s own words cut through the debate: “The bad guys won’t rest. Probably not. But we will.”

There is a two-tier system now. If your organization depends on curl and finds a vulnerability in July and cannot wait, there is a support contract option. Everyone else queues up. GitHub issues and pull requests remain open. Only the security vulnerability channel is paused.

Stenberg invited other open source projects to join the summer of bliss. Whether anyone takes him up on it is another question. The curl project is unusual in that one person has maintained it for nearly thirty years and can make this call unilaterally. Most projects of comparable criticality have corporate backing, security teams, and SLA obligations that make a month-long pause impossible. That curl can do this at all says something about its governance structure. That it needs to says something about the state of AI-assisted vulnerability reporting.