WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Jan 26, 2026

Don’t Insert Crazy! On cURL and AI Slop - Daniel Stenberg

Daniel Stenberg

Daniel Stenberg warns that AI-generated slop is destroying the open source ecosystem. Learn why the cURL creator finally killed his bug bounty program to stop the madness.

Pause
Mute Enter Fullscreen
#1 about 2 min

The ubiquity of the curl library in connected devices

Widespread reliance on foundational network libraries makes them a ubiquitous component in connected hardware.

#2 about 3 min

Shutting down the bug bounty program due to AI

Surges in automated chatbot submissions make evaluating generic security claims unsustainable for maintainers.

#3 about 5 min

Hallucinated vulnerabilities and automated bug hunting

Artificial intelligence tools frequently generate plausible but entirely fabricated vulnerability reports based on common language patterns.

#4 about 5 min

Moving vulnerability reporting to GitHub to deter bounty hunters

Shifting bug reports to platforms without direct payout incentives filters out low-effort automated submissions.

#5 about 3 min

Why standard pull requests face less AI spam

Automated continuous integration checks easily filter out non-functional code submissions before maintainer review.

#6 about 4 min

How AI code generation threatens open source feedback loops

Generating code without acknowledging external dependencies breaks the cycle of usage reporting and contributor recognition.

#7 about 6 min

Evaluating HackerOne metrics against fake vulnerability claims

Popular open source repositories face disproportionate amounts of fabricated security reports from users seeking monetary rewards or career advancement.

#8 about 4 min

Monetizing open source despite AI traffic interception

Alternative monetization strategies become necessary when generative AI tools intercept documentation traffic and reduce ad revenue.

#9 about 5 min

Commercial support contracts and maintainer succession planning

Providing long-term enterprise support requires established bus factor contingency plans for core maintainers.

#10 about 3 min

Code refactoring and the lifespan of software vulnerabilities

The latency between introducing a bug and its discovery complicates measuring the success of ongoing code refactoring efforts.

#11 about 2 min

Balancing library resilience with user responsibility for API inputs

Clear documentation must define the boundary between safe library usage and deliberate misuse by the caller.

#12 about 4 min

Supporting modern network protocols in foundational libraries

Foundational open source tools must continuously evolve to support modern web standards like HTTP/3.

#13 about 6 min

The necessity of human verification in security reporting

Submitting security claims requires independent logical reproduction rather than naive acceptance of automated tool outputs.

#14 about 2 min

Identifying AI-generated text patterns in issue tracking

Maintainers can identify generative AI submissions through distinct linguistic markers like excessive apologies and structured bullet points.

Matching moments

2:18 min

Handling the surge of AI-generated open-source code contributions

Michele Zuccala Michele Zuccala +4 · WWC Europe 2026

2:05 min

The disproportionate impact of AI vulnerabilities on open source

Adrian Mouat Adrian Mouat · WWC Europe 2026

1:59 min

Navigating the impact of AI on open source maintenance

Sinduri Guntupalli Sinduri Guntupalli · WWC Europe 2026

7:02 min

Managing AI generated code and slop in open source

Chris Heilmann +2 · LIVE

4:15 min

Security integration and AI skepticism in developer tooling

Chris Heilmann +2 · LIVE

1:34 min

Navigating security risks in AI-assisted open source contributions

Cédric Gégout Cédric Gégout +4 · WWC Europe 2026

More from Coffee With Developers

What to Do About Hackathons in the Time of Agents - Mike Swift thumbnail
46:03
9 days ago

What to Do About Hackathons in the Time of Agents - Mike Swift

Mike Swift

Moving from Playing with AI to Implementing AI - Lee Stott thumbnail
18:43
13 days ago

Moving from Playing with AI to Implementing AI - Lee Stott

Lee Stott

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
22 days ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert thumbnail
4:57
27 days ago

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert

Matt Zeunert

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify) thumbnail
40:29
about 2 months ago

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify)

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel thumbnail
32:22
about 2 months ago

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel

Upcoming sessions on this topic

Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

When Humans Stop Writing Code: Rethinking Languages, Compilers, and Responsibility

Simon Auer

Organizer of flutter vienna meetup and CEO of marqably

Simon Auer
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

The spectrum of agentic coding: From vibe coding to high-quality software engineering

YK Sugi

Developer Experience Manager at Eventual

YK Sugi
Open session

World Congress 2026 North America

The Broken Rung: How AI is Rebuilding Software Development from the Ground Up

Tomislav Tipurić

Chief Technology Officer, Nephos

Tomislav Tipurić

Related videos

WeAreDevelopers Live: Browser Extensions, Honey Scam, Jailbreaking LLMs and more thumbnail
1:01:25
LIVE • over 1 year ago

WeAreDevelopers Live: Browser Extensions, Honey Scam, Jailbreaking LLMs and more

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking thumbnail
56:03
LIVE • over 1 year ago

WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking

Chris Heilmann, Daniel Cranney, Ramona Schwering

Surviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World thumbnail
27:56
WWC Europe 2026 • about 1 month ago

Surviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World

Adrian Mouat

Five things in tech that matter and we have to make work thumbnail
17:01
WWC 2025 • 12 months ago

Five things in tech that matter and we have to make work

Christian Heilmann

WeAreDevelopers LIVE: Scammer Payback with Python, Grok Goes Unhinged, The Future of Chromium and mo thumbnail
1:01:44
LIVE • over 1 year ago

WeAreDevelopers LIVE: Scammer Payback with Python, Grok Goes Unhinged, The Future of Chromium and mo

Dan Cranney, Chris Heilmann, Brian Rountree

WeAreDevelopers LIVE – AI vs the Web & AI in Browsers thumbnail
53:46
LIVE • 10 months ago

WeAreDevelopers LIVE – AI vs the Web & AI in Browsers

Chris Heilmann, Daniel Cranney, Raymond Camden

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.