curl's confirmed-vulnerability rate fell from above 15 percent to under 5 in 2025

A reviewer's first pass is a hunt for uncertainty markers: a TODO, a comment saying "not sure this is right," a function that clearly was not finished ^[3]. That scan is cheap, and it decides where the expensive reading goes. For years the best review signal on a team was a comment admitting doubt, and nobody counted it as documentation. Devrim's year of retrospectives found that generated bugs arrive without those traces and pass review and pass tests as often as human code does ^[2][4].

A model emits the same surface confidence for a pattern it has seen thousands of times and for the case where an undocumented constraint breaks the textbook answer. It is predicting what is statistically likely to come next, and it has no way to register what it has not seen ^[5]. Alex Carter's account is the concrete instance: a database query that worked fine in every normal case and was quietly vulnerable to injection under a specific set of inputs nobody had tested ^[6][7]. He wrote that a human who does not understand something usually leaves a trace of that uncertainty, and that AI implements the wrong thing with total confidence ^[8].

curl runs inside billions of devices, including cars, TVs, phones and a large share of the servers running the internet ^[17]. Its HackerOne program ran for six years, paid out more than $100,000 and confirmed 87 real vulnerabilities at a confirmed rate north of 15 percent ^[9][10]. Work the rate backwards: 87 confirmed at 15 percent implies fewer than about 580 reports across six years, under 100 a year, close to two a week ^[1][2]. Seven arrived inside one 16-hour window by January 2026, and reading each one, trying to reproduce the claimed exploit and tracing the referenced code paths returned zero vulnerabilities ^[13]. At the old rate, seven reports would have been expected to yield about one ^[4].

The payouts work out to roughly $1,149 for each confirmed vulnerability ^[3], with no line covering the triage hours. Stenberg shut the program down ^[14], and said the goal was to remove the incentive for people to submit reports that were not properly researched, "AI generated or not" ^[15].

The confirmed rate had already collapsed below 5 percent during 2025, a fall of at least three times. The dev.to writeup attributes that to AI making it trivially cheap to produce reports with technical language, specific function names and plausible-sounding attack scenarios and nothing real behind them ^[11][5][12]. That series counts inbound vulnerability reports. Shipped code is a different pipeline, and the claim about code rests on two practitioner accounts recounted secondhand ^[1][6]. The same writeup reports at least four Sev-1 incidents at Amazon between December 2025 and March 2026, including a six-hour outage tied to an estimated 6.3 million lost orders. It does not say what tied any of them to generated code ^[16].

The rule behind the shutdown travels to a code review queue in a way the 5 percent number does not: it tests whether a submission reproduces and never asks who wrote it ^[15]. Applied to a diff, that means reading the code path against the constraint it is supposed to satisfy. Devrim's year of bugs says review and tests do not separate the two sources on their own ^[4].