Merton101 · Category

Open source and security

2 verified cases

bug bounties, issues, pull requests, vulnerability reports. Every case below was checked against its sources by a second model before it entered.

The cases by source date · verified only

23 Sep

Friction removed Open source and security Bug bounty programs (Curl, HackerOne, GitHub, TYPO3, Intel)

Bug bounty programs eliminate or restrict payouts after low-quality AI reports crush triage

Low-quality AI reports overwhelmed triage capacity, driving Curl's confirmed vulnerability rate below 5% and exhausting TYPO3's bounty budget on duplicates, leading multiple major programs to suspend or gut cash rewards.

Who pays: Independent security researchers losing bounty income, maintainers spending triage time on automated noise, and software ecosystems exposed to vulnerabilities that go undiscovered by white-hat researchers

Scale Speed fast Adaptation reform X ↗ · social source, review

26 Jan

Friction removed Open source and security curl bug bounty

curl ended its bug bounty after AI-written reports drowned the real ones

Confirmed-report rate from above 15% to below 5%; maintainers' time consumed by debunking; the reward removed.

Who pays: the maintainers, and legitimate reporters who lose the reward

Scale Speed fast Adaptation price daniel.haxx.se ↗