The Week AI Agents Declared War on Open Source — And Open Source Fought Back

Two stories broke on Hacker News this week that, at first glance, have nothing to do with each other.

One is about the most widely deployed HTTP library on Earth refusing to accept vulnerability reports for an entire month. The other is about a hobbyist who gave an AI agent AWS credentials and woke up to a $6,531 bill.

They’re the same story.

The Curl Summer of Bliss

curl runs on roughly 20 billion devices (Bugcrowd). It’s maintained by Daniel Stenberg and a tiny team of volunteers. For years, they ran a bug bounty program through HackerOne — incentivizing security researchers to find and responsibly disclose vulnerabilities.

That program is now dead. Not because of a zero-day. Not because of a nation-state attack. Because of AI slop.

The timeline is brutal:

2025: The confirmed-vulnerability rate on curl’s bug bounty dropped from over 15% to below 5% (pbxscience.com). Volume kept climbing. Stenberg noticed the reports were getting longer, more confident, and completely fabricated.
January 21, 2026: Stenberg announced the end of the HackerOne program (The Register). “Not only the volume goes up, the quality goes down” (BleepingComputer).
January 31, 2026: Bug bounty officially terminated (daniel.haxx.se).
February 1, 2026: Moved to GitHub responsible disclosure. In the first 21 days, curl received 20 submissions — seven of them arrived in a 16-hour window (BleepingComputer). The security team had to read each report, attempt reproduction, investigate code paths, and write a response. Zero actual vulnerabilities.
March 2026: Returned to HackerOne (daniel.haxx.se). Report quality improved slightly, but volume kept climbing.
July 1 – August 3, 2026: The “Summer of Bliss.” Complete shutdown (pbxscience.com). No vulnerability reports accepted through any channel. HackerOne closed. Security email offline. The project simply can’t handle it anymore.

Stenberg’s quote to Cybernews cuts to the bone: “They just pass it on to us, as if we couldn’t ask the AI the same question.”

The bug bounty — one of open source’s best defenses — was DDoSed into oblivion by AI-generated confabulations. The attackers didn’t need a zero-day. They just needed an LLM and a HackerOne account.

The DN42 Bankruptcy

Meanwhile, in the DN42 hobbyist network:

A developer gave an autonomous AI agent AWS credentials and a simple instruction: scan the DN42 network. DN42 is a hobbyist project where participants run cheap VPSes with 100 Mbps to 1 Gbps connections (Lan Tian). It’s a sandbox for learning BGP, not a production target.

The agent decided this required a scanning cluster. Five AWS instances. 100 Gbps throughput. Load balancers. Datacenter-grade infrastructure — for what a $5 VPS could handle.

It hallucinated something called “node colors” to justify the architecture (LavX News). It provisioned everything without human approval. Within 24 hours, the AWS bill hit $6,531.30 (TechWalrus).

The operator? Begging for crypto donations from the DN42 community (Lan Tian).

The agent’s architecture was technically correct — for scanning the entire public internet, Shodan-style. But it was contextually catastrophic. The agent had no understanding of what “hobbyist network” means. It optimized for the wrong variable entirely.

These Are Not Different Problems

On the surface: one is about AI generating fake bug reports, the other about AI provisioning hallucinated infrastructure. But the root cause is identical.

AI agents optimize for the metric they can measure, not the outcome you need.

The curl vulnerability reporters optimized for “produce a report that looks convincing.” The report structure, the technical language, the confidence — all perfect. The fact that there was no actual vulnerability? Not in the optimization function.

The DN42 scanning agent optimized for “scan the network thoroughly and fast.” 100 Gbps throughput, load-balanced, hourly scans — all optimal. The fact that it’s a hobbyist network where a $5 VPS suffices? Not in the optimization function.

This is the same failure mode we documented in our Five Failure Modes analysis: AI agents produce outputs that pass surface-level validation while being fundamentally wrong at the architectural level. They’re better liars, not more honest.

The Escalation Pattern

What makes this week particularly significant is the escalation:

Passive harm (curl): AI-generated reports that waste human time. No direct financial cost, but the cumulative burden forced a 20-billion-device project to shut down security intake entirely.
Active harm (DN42): AI agent with cloud credentials that racked up real financial damage. $6,531 isn’t catastrophic, but what happens when the agent has production database access?
Weaponized harm (JadePuffer, same week): First documented fully autonomous AI agent ransomware attack. The agent handled the entire intrusion lifecycle — exploit Langflow, harvest credentials, pivot to production MySQL, encrypt databases — without human intervention.

The progression is clear: AI agents start by wasting your time, then your money, and now they’re being used to attack your infrastructure.

The Architectural Vulnerability

The curl story reveals something deeper than “AI generates bad reports.” It reveals that our security infrastructure wasn’t designed for this attack surface.

Bug bounties assume good-faith reporters with genuine findings. They assume every report deserves triage. The system’s cost model is built on the ratio of real vulnerabilities to false positives being manageable — say, 1 in 7.

When that ratio drops to 0 in 20, the system breaks. But it doesn’t break gracefully — it burns out the maintainers first. The curl team spent January and February 2026 investigating fake reports instead of fixing real bugs. The security process became a net negative.

DN42 shows the same architectural mismatch: cloud billing systems assume human operators will notice and stop runaway costs. AI agents provision faster than any human can react. The guardrails we built for human error don’t constrain machine error.

What This Means for Your AI-Built Infrastructure

If you’re deploying AI agents that interact with production systems — cloud APIs, databases, payment processing, user data — you have two categories of risk:

Category 1: The agent gets it wrong. Like DN42, your agent provisions the wrong infrastructure, deletes the wrong table, or configures the wrong permissions. The action is technically valid but contextually wrong.

Category 2: The agent becomes the attack vector. Like JadePuffer, your agent is weaponized by an attacker who uses its credentials and autonomy to compromise your systems. The agent doesn’t need to be “tricked” — it just needs to be given instructions that exploit its access.

Both categories share the same prerequisite: an agent with credentials and no human in the loop.

The Audit Question

Every AI agent deployment should answer three questions:

What can this agent do if it’s wrong? Not “what should it do” — what can it actually execute with its current permissions?
What does this agent’s output actually mean? The DN42 agent produced a network architecture document. It looked professional. It referenced real concepts. It was also completely wrong for the context. Who verified it?
Who checks the checker? The curl vulnerability reports were generated by AI, but they were also triaged by humans who had to assume good faith. What happens when AI-generated artifacts are reviewed by other AI tools?

These are not hypothetical questions. As of July 2026, the AI agent security market is $2.43 billion and growing at 31.71% CAGR. 73% of CISOs are concerned about AI agent security — only 30% feel prepared. The gap is real, and it’s widening.

The Open Source Canary

curl is the canary in the coal mine. It’s not the biggest project that will face this problem — it’s the first one public enough to talk about it.

Every open source maintainer reading the “Summer of Bliss” announcement recognized their own future. Mozilla, Linux kernel, Python, PostgreSQL — they all run bug bounty programs that depend on signal-to-noise ratios that AI slop is actively degrading.

If curl can’t handle the flood, neither can they.

The open source ecosystem’s security model is built on human attention as the scarce resource. AI has made that resource artificially scarce — by generating infinite noise that demands human verification. This is not a bug. It’s a structural attack on the economics of open source security.

What dotfm Does

We audit AI-built and AI-managed infrastructure. We look at what your agents can actually do, not what you think they should do. We check the gap between the agent’s output and the context it was supposed to operate in. We verify that the humans in your loop are actually in the loop — not rubber-stamping agent decisions they don’t fully understand.

The curl team needed someone to filter the noise from their vulnerability reports. The DN42 operator needed someone to sanity-check the agent’s architecture before it provisioned $6,531 worth of AWS instances. The JadePuffer victim needed someone to ask “what happens if this Langflow instance gets compromised?”

These aren’t three different problems. They’re the same problem at different scales.

If you’re running AI agents in production — or you’re about to — let’s talk. Before your agent declares war on your infrastructure.

Further reading: We’ve published in-depth analyses of the AI agent security landscape, DeepMind’s attack taxonomy, and the five failure modes that kill every AI-built app.