开源维护者被 AI 安全报告淹没的现状值得所有依赖 curl 的团队关注——这暴露了 AI 辅助安全研究的双刃剑效应，做开源维护或安全研究的人看完会有感触。
curl 项目维护者 Daniel Stenberg 透露，由于 AI 辅助生成的安全报告激增，项目正面临前所未有的压力。2026 年安全报告提交速度是 2024 年的 4-5 倍，平均每天超过一份，且报告质量极高、细节详尽。维护团队的工作量已严重失衡，甚至影响到家庭生活。好消息是，这些报告发现的漏洞多为低危或中危，自 2023 年 10 月以来未出现高危漏洞。
The pressure
The pressure Daniel Stenberg on the unprecedented level of pressure the curl team are facing right now thanks to the deluge of (credible) AI-assisted security issues being reported. The rate of incoming security reports is 4-5 times higher than it was in 2024 and double the speed of 2025 -- meaning that on average we now get more than one report per day . The quality is way higher than ever before. The reports are typically very detailed and long. [...] For the first time in my life, my wife voiced concerns about my work hours and my imbalanced work/life situation. I work more than I’ve done before, but the flood keeps coming. [...] This is a never-before seen or experienced pressure on the curl project and its security team members. An avalanche of high priority work that trumps all other things in the project that is primarily mental because we certainly could ignore them all if we wanted, but we feel a responsibility, we have a conscience and we are proud about our work. The good news is that curl is a very solid piece of software, so the vulnerabilities people are finding tend not to be of high severity: What is also a good trend: almost no one finds terrible vulnerabilities. All vulnerabilities found the last few years in curl have all been deemed severity LOW or MEDIUM. I'm not saying there won't be any more HIGH ever, but at least they are rare. The most recent severity high curl CVE was published in October 2023. Via Lobste.rs Tags: curl , security , ai , generative-ai , llms , daniel-stenberg , ai-ethics , ai-security-research