Is vibe coding killing open source? The cURL case

WAIT, Vibe Coding is killing Open Source?

cURL is free, open-source software that runs behind almost everything you use on the internet. Its creator had a program going since 2019: you found a security bug, you reported it, you got paid. In 6 years it paid out USD $86,000 and found 78 real vulnerabilities.

He shut it down in January.

Before, more than 15% of reports were valid. In 2025 it dropped to under 5%. The volume went up eightfold. People asking AI to find bugs, copying whatever came out, and sending it without checking. Reports that sound serious. But there's nothing in them.

In six years: not a single AI-generated report without human oversight found a real vulnerability. Zero.

But here's a question I can't answer: are there really fewer bugs in code today, or are there just fewer people reporting them properly? And was that 15% from before really that clean, or was part of that success also inflated by better-disguised AI that nobody caught?

I don't know. And I don't think anyone knows for sure.

What I do know is that when the tool does the work and nobody checks it, the output is worthless. Doesn't matter if it's a security report or a landing page or whatever it is you publish.

AI doesn't take responsibility for what it generates. That's still on you.