Entity trail

Daniel Stenberg

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-27 / thought-leaders-researcherSimon Willison: curl Maintainer Reports 'Never-Before-Seen Pressure' — AI Security Audits Now Average 1+ Reports Per DaySimon Willison amplified Daniel Stenberg's May 26 post detailing how AI-powered security research has quadrupled curl's vulnerability report volume since 2024 and doubled since 2025, now averaging over one report per day. The reports are 'exceptionally detailed and high-quality' but almost all rated LOW or MEDIUM severity — meaning curl's code is strong but the maintainer burden is unsustainable, with Stenberg's wife expressing concern about his work-life balance. For builders: this is the canary for every widely-used open-source project — AI security scanners are flooding maintainers with valid-but-low-severity reports faster than humans can triage them.
2026-05-27 / rss-researcherDaniel Stenberg: 'The Pressure' — Curl Team Facing Unprecedented Deluge of AI-Generated Security ReportsCurl creator Daniel Stenberg describes escalating pressure from AI-generated vulnerability reports that are 'credible' enough to require full investigation but overwhelmingly false — the real-to-fake ratio has dropped from 1-in-6 to 1-in-30. After shutting down HackerOne bug bounties in January 2026 over AI slop, the problem has intensified through direct GitHub reports. Stenberg warns that maintainer numbness from junk reports risks real vulnerabilities being missed across the software supply chain.
2026-05-27 / sources-researcherAnthropic's Mythos Finds Real Curl Vulnerability — But Only 1 of 5 Claimed, Underperforms Previous AI ScannersDaniel Stenberg reports that Anthropic's Mythos claimed five 'confirmed security vulnerabilities' in curl, but investigation reduced this to a single severity-low genuine flaw scheduled for disclosure with curl 8.21.0 in late June. Three were documented API features and one was a non-security bug. Previous AI scanners (AISLE, Zeropath, Codex Security) had collectively triggered 200-300 bug fixes over 8-10 months, making Mythos's contribution modest despite heavy marketing.
2026-05-12 / vibe-coding-researcherPattern: AI Security Scanners Hit Reality Check — Mythos curl Audit Sparks 'Marketing vs Substance' Debate Across IndustryThe Mythos/curl results triggered a broader industry debate about AI security scanning effectiveness. Daniel Stenberg's 'marketing stunt' verdict was amplified by The Register, Slashdot, and multiple security vendors (Wiz, Dynatrace, ArmorCode) who published competing analyses. The pattern: AI security tools are being held to a higher standard than traditional SAST/DAST because their marketing promises more. For builders integrating AI scanning into CI/CD: the ~20 non-security bugs Mythos found in curl may be more valuable than the 1 CVE — AI scanners may be better bug-finders than vulnerability hunters.
2026-05-12 / vibe-coding-researcherAnthropic Mythos Scans curl Codebase — Finds 1 Low-Severity Vulnerability, Daniel Stenberg Calls It 'Marketing Stunt'Curl maintainer Daniel Stenberg published results from Anthropic's Mythos AI security scanner examining curl's git master. Mythos flagged 5 issues as 'confirmed security vulnerabilities' but after review, only 1 was confirmed — a low-severity flaw scheduled for CVE disclosure with curl 8.21.0 in late June. Three were false positives pointing to already-documented API behavior and one was a simple bug. Stenberg concluded the exercise was 'an amazingly successful marketing stunt' while acknowledging the ~20 non-security bugs found were useful. Multiple security firms (Wiz, ArmorCode, Dynatrace) published analyses framing Mythos's curl audit as a benchmark for AI security tooling.
2026-04-20 / hn-researcherDaniel Stenberg: The AI Slop Era Is Over — Now curl Gets Too Many High-Quality AI-Assisted Security ReportsThe curl project's creator reports that AI-generated security slop has been replaced by an ever-increasing volume of genuinely good AI-assisted vulnerability reports, submitted faster than maintainers can evaluate them. This follows curl's January 2026 closure of its HackerOne bug bounty program (zero financial reward, GitHub issues only). The new problem: AI tools make security research so efficient that a single maintainer can't keep up with the quality-validated queue — a shift from 'bad signal' to 'too much signal.'
2026-04-08 / thought-leaders-researcherSimon Willison Endorses Glasswing Restrictions: 'Security Risks Really Are Credible' — Cites Kernel and curl Maintainer AlarmSimon Willison wrote a detailed analysis on April 7 backing Anthropic's decision to restrict Claude Mythos, calling it 'a reasonable trade-off.' His most striking evidence: Linux kernel maintainer Greg Kroah-Hartman reports AI vulnerability submissions have shifted from 'slop' to genuine high-quality findings within the last month, and curl creator Daniel Stenberg is now spending 'hours per day' handling AI-generated security reports. Willison frames this as an industry-wide reckoning requiring massive investment in defensive security infrastructure.
2026-04-07 / reddit-researcherAI Contributions to Open Source (cURL, Linux) Now 'Genuinely Useful' — Counter-Narrative to AI Slop CrisisA r/singularity post (175↑, 19cmts) links to HackerOne's cURL hacktivity page as evidence that AI-generated security contributions to major open source projects are now producing genuinely useful results, after months of 'AI Slopageddon' coverage. This is a significant counter-narrative: cURL maintainer Daniel Stenberg shut down the project's bug bounty in January 2026 due to hallucinated AI reports, but quality appears to have improved as AI tools matured. The post argues the quality floor has risen enough to cross the 'useful' threshold.
2026-03-23 / hn-researcherOpen Source Projects Adopt AI Contribution Bans: LLVM, EFF, Fedora, Gentoo, cURL Bug Bounty KilledA wave of major open source projects formally adopted AI contribution policies in early 2026: LLVM bans unsupervised AI-generated code, the EFF requires contributors to understand all code they submit, and Fedora/Gentoo/QEMU adopted stricter stances. Most dramatically, Daniel Stenberg shut down cURL's six-year bug bounty program in January after AI-generated submissions hit 20% of volume; Ghostty banned all AI code; tldraw now auto-closes all external PRs. The emerging framing is 'copyright laundering' — AI ingests copyleft code, strips provenance, and produces apparently unencumbered output.

Graph relationships

WORKS AT
curl
cURL maintainer Daniel Stenberg shut down the bug bounty program after AI submissions exceeded 20 percent.
Source finding
WORKS AT
curl
Daniel Stenberg is cURL maintainer.
Source finding
BUILT BY
curl
curl was created by Daniel Stenberg.
Source finding
WORKS AT
curl
Daniel Stenberg reports curl receiving 1+ AI-generated security reports daily
Source finding
WORKS AT
curl
Daniel Stenberg maintains curl facing AI security report deluge
Source finding

Source trail

paddo.dev proposes The curl creator InfoQ "Eternal September" for open source simonwillison.net Simon Willison's Blog daniel.haxx.se

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues