daniel.haxx.se
“ignore the slop”
Lots of people who are against the use of AI for all its ethical and inherent issues tell me this. _Just ignore it_. Don’t let _big AI_ control us.
The “slop” they refer to is anything created that involved an AI, and in our case (the curl project) it is in particular vulnerability reports.
“Ignoring the slop” _cannot be done_ and it doesn’t help. Vulnerability reports created with the help of AIs point out actual problems, and sometimes vulnerabilities. Ignoring real vulnerabilities because they were found by AI does not make users safe and secure. It makes them vulnerable. _We don’t want that_.
I personally don’t refer to this as _AI slop_ because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.
One can certainly object to the use of AI, but when we get real vulnerabilities reported and proven, we cannot in good faith pretend they don’t exist just because we think the tech involved in digging them up is questionable. That would be a disservice to, or even betrayal of, our users.
We make curl secure for our users.
## Obligations
An Open Source project typically gives no guarantees at all, so there are no _legal_ requirements that force us to fix flaws.
We are however a project with high goals of quality and stability and we would jeopardize our name and track record if we now would stop delivering on that. Also, a few of us involved in the project also sell curl related support and services, where at least part of that means providing _secure_ curl releases, so we still have this _contractual obligation_ to a set of customers. And they wouldn’t be customers in the fist place if the Open Source project didn’t already have the proven quality track record.
So no, we really cannot ignore vulnerability reports.
## The slop is gone
A sizeable portion of users seem to still believe we still suffer from a lot of made up and hallucinated reports by these AIs. We really don’t.
Almost all the stupidity and lies we saw in the vulnerability reports made by AIs in the past have ceased. Since spring 2026 the slop reports are practically gone. Our current challenge is much harder: high volume, high quality.
## AI talks too much
They always use too many words. Every report is now hundreds of lines and the explanations are convoluted and detailed (and often repeat themselves multiple times).
In a good report, the human writes a first paragraph explaining the problem _briefly_ and then they submit the full report. It’s annoying when the reporter surrender everything to the AI, including the communication part.
The AIs are also still bad at figuring out exactly there the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is. This is not a surprise though, as this is also the case for human reporters.
A good trend is that they often produce good reproducers or proofs of concept helping to trigger and prove the problem/vulnerability. That was a really complicated part of the reporters’ work back in the day, now it’s just a prompt or two.
## Everything is with AI now
These days, like within the last few months, we have received hundreds of vulnerability reports submitted to curl and _every single one had AI involved to some extent_.
It is generally easy to tell on the language and the length and details of the report.
