Since April 2019 the curl project had run a bug bounty, paying cash for confirmed security vulnerabilities. It stopped on January 31, 2026. Daniel Stenberg, announcing the change for the curl team, gave the numbers: in earlier years somewhat more than 15% of submissions turned out to be confirmed vulnerabilities, and from 2025 the rate fell below 5%. He points to AI-generated reports and weaker human ones, and allows that the easy bugs may simply have been found already. Over its life the program confirmed 87 vulnerabilities and paid out more than $100,000. The team dropped the reward to remove the incentive to file invented reports, and moved intake off HackerOne.
The cost side appears in a post from July 2025. The security team had seven members, and each report drew in three or four of them for half an hour, sometimes up to three hours, apiece. Some members had about three hours a week for curl in total. Submissions averaged about two a week, roughly a fifth of them AI-generated by his count, and every one had to be assessed by the same people whether it was real or not.
Strip out the security details and the arithmetic is general. AI made a report cheaper to produce; for curl’s team it did not make one any cheaper to assess. When an item costs less to make than to absorb, volume rises until the reader’s hours run out, and past that point the surplus waits or goes unread. Suppose a product manager can read and act on ten customer research summaries a week, and AI lets the research team send 25. The pile grows by 15 a week; after eight weeks 120 summaries are waiting, twelve weeks of reading at the manager’s pace. In practice a reader rarely works through a pile in order. The manager skims and skips, the surplus becomes work nobody used, and the one summary that mattered sits among the rest.
Ethan Mollick showed how cheap the making has become when he asked Claude to turn one memo into a slide deck, then another from a different angle, and kept going until he had seventeen. He warns that unless we think hard about why we are doing a piece of work, we will drown in AI content, and he puts the remedy in judgment about what is worth doing. I agree, and would add that the judgment needs a place where it is enforced. Inside a company, a memo, an analysis or a third version of an account plan is rarely counted as a submission, so the pile stays out of sight until a reader stops reading or two teams act on different versions of the same analysis. The reader’s hours do not grow with the writer’s tools.
The case for abundance is that unread drafts are cheap to ignore. More drafts mean more options, and a reader can skim and discard. Two things limit that. Discarding still costs time per item, which is the bill curl’s team was paying. And options help only when someone has the hours to compare them; otherwise they add to the backlog. Where an artifact asks nothing of anyone, such as a reference page or a dashboard no one has to act on, the objection holds and the volume does little harm. The problem is confined to work that asks a person with fixed hours to read, decide or act.
The curl decision also suggests where that judgment should be enforced. Using HackerOne’s numbers, Stenberg found that curl’s inbound volume had risen sharply over four quarters while comparable open source bounty programs such as Ruby, Node and Rails stayed flat or fell slightly, and he suspects the money explains much of the difference. So the team removed what paid for arrivals. The internal equivalent, in my view, is a dashboard that credits producers for hours saved or documents generated: it rewards arrivals and says nothing about the reader. The intake rules I would set are plain. Each generated piece of work names the person who asked for it and will use it. Each reader has a cap on open items waiting for them. Anything unread past a set date expires and leaves the queue.
An AI rollout that raises output while the readers stay fixed will report hours saved at the producer and longer waits at the reader, and only the first number tends to reach the adoption review.