AI slop attacks on the curl project - Daniel Stenberg
Daniel Stenberg1 HN recommenders · 2025–2026
46K views · talk · news · Uploaded 2025-08-16
Daniel Stenberg's keynote at FrOSCon 2025 on AI slop attacks on the curl project, with examples of bogus AI-generated security reports. He discusses the toll on maintainers and why various countermeasures don't fit the project.
HN points to it when discussing AI-generated bug reports and vibe-coded pull requests burdening open source maintainers.
51:32Behind the Scenes of iOS Security
Black Hat
1:03:55🚀 TDD, Where Did It All Go Wrong (Ian Cooper)
DevTernity Conference
32:56Bret Victor The Future of Programming
Joey Reid
12:01Why Electronic Voting Is Still A Bad Idea
Tom Scott
27:14Transformers, the tech behind LLMs | Deep Learning Chapter 5
3Blue1Brown
51:22USENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
42:50Defcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
1:18:21"Uncle" Bob Martin - "The Future of Programming"
Paul Stringer's Mobile Tech
5 comments from Hacker News
Maintainer or curl gave recently a talk on AI slop in security reports, showing this and other examples: [VIDEO] -- AI slop attacks on the curl project - Daniel Stenberg. Keynote at the FrOSCon 2025 conference, August 16, in Bonn Germany by Daniel Stenberg. Plus, linked above, his blogpost on the same subject [LINK]
last month curl developer Daniel Stenberg gave a talk "AI slop attacks on the curl project" : [VIDEO]
Daniel Stenberg of curl gave a talk about some of what theyve been experiencing, mostly on the security beg bounty side. A bit hyperbolic, and his opinion is clear from the title, but I think a lot of maintainers feel similarly. “AI Slop attacks on the curl project” [VIDEO]
> the problem at hand is one of high asymmetry between the low effort to submit vs the high effort to review Hence the threat to shame publicly I suppose. Actually, Daniel Stenberg previously responded to this proposal the same way as me [1] (and maybe would still do). Coincidentally, I was reading your answer at about the same time as this part of the talk. [1] [VIDEO] (via [LINK] )
A lot of solutions have been suggested over the past few months, including those. They have drawbacks and it’s not how they want to run the project. [VIDEO]