Open Source Security in spite of AI#

Daniel Stenberg (curl)

• Why: Not a core-interest topic, but a field-level signal you wouldn't search for: the maintainer of curl describing how AI is simultaneously degrading and improving open-source security work.
• What: Two-sided evidence from one project: large volumes of low-quality AI-generated "security reports" acting as a denial-of-service on maintainers (plausible-looking rubbish that must be triaged), alongside genuinely new AI-powered code analysis finding real flaws in curl in ways no previous analyzer could — some findings "feels almost human."
• How: (From the abstract: concrete examples of both the slop reports and the AI-found bugs, named tools, and the operational impact on a small maintainer team.)
• Where applicable: Every open-source project your supply chain depends on — if you run a security or PSIRT function, expect report volume to keep climbing while triage cost shifts to you. (from abstract only — no slides available)