June 26, 2026
The Slop Flood
This post is part of my Medium blog.
curl is in billions of devices. It's the backbone of HTTP communication. If you used the internet today, curl was involved. And curl is, for practical purposes, one guy.
Daniel Stenberg has maintained curl for over twenty-five years. In January 2026, he shut down the project's bug bounty program — not because the bugs stopped, but because the reports stopped being real.[^1] That's the story everyone's telling: AI slop is flooding open source, maintainers are drowning, the ecosystem is in crisis. It's a real crisis. The volume numbers are staggering.
But when I pulled the data, it told a different story. Here's the part nobody's saying out loud: a lot of the open source we depend on is a dude writing code for twenty years. The "community" was a maintainer and a handful of helpers. And weirdly, that's what a lot of these projects always were — vanity projects with a public repo. One person's name on the code, one person's vision, one person deciding what gets merged. The slop flood didn't break a working community model. It exposed which projects never had one — and how much of our infrastructure was resting on that fiction.
The data on curl
I pulled curl's GitHub numbers going back to 2020 — four years before AI coding tools went mainstream.[^2] In 2020, curl received 1,038 pull requests. By 2025, that was 3,540 — a 241% increase. The project didn't get 241% more popular. The codebase didn't grow 241%. What changed was that AI coding tools made it trivial to generate a pull request.[^3]
But here's what the data shows about who was actually doing the work. In 2020, Stenberg personally submitted 497 of the first 1,000 PRs — just under half. The next most active contributor submitted 91. After that, it drops to 50, 39, 27. That's not a community. That's one man and a few helpers. The internet's HTTP infrastructure runs on a project where the second-most-active contributor submitted 91 PRs in a year.[^4]
While PR volume was exploding, the number of unique humans submitting PRs went the other direction. In 2020, 168 unique authors. In 2023, 150. In 2025, 92. In 2026 — still only half over — 74. The number of humans contributing is collapsing while the volume of contributions is tripling. Do the math: in 2020, each non-Stenberg contributor submitted an average of 3.0 PRs. By 2026, 10.1. Fewer people, each generating more than three times as many pull requests. That's not community growth. That's a smaller group of people running AI tools that spray contributions at a project they may not fully understand.[^4]
Stenberg's own share tells the story from the other side. In 2020, he was 49.7% of PRs. By 2026, 26.4%. He's submitting fewer PRs in absolute terms (264 vs. 497), but the flood from everyone else has grown so fast that his work is now a quarter of the total instead of half. The project didn't gain contributors. It gained volume.
This isn't a new problem
The Apache Software Foundation has been trying to prevent this exact scenario for over two decades. Their incubator graduation guide states it plainly: a project is considered to have a diverse community "when it is not highly dependent on any single contributor." The requirement is at least three legally independent committers, with no single company or entity vital to the project's success.[^11] The ASF didn't write that rule because they were worried about AI. They wrote it because they knew — from decades of experience — that one-person projects are fragile, and that fragility becomes everyone's problem when the project is critical infrastructure.
The ASF built governance structures around this. Project Management Committees vote on new committers. Committers are elected based on merit. Releases require formal votes. No single person can unilaterally ship or block a release. The "Apache Way" — consensus-based, community-driven — exists specifically because the alternative is a project that lives or dies with one person's mood, availability, and willingness to keep going.[^12]
Most of open source isn't ASF-governed. Most of open source is on GitHub, with no governance structure at all. ecosyste.ms tracks 11.8 million open source projects. Roughly 7 million of them — sixty percent — are maintained by a single individual.[^13] That's not a community model. That's a person with a public repository. Some of those projects are brilliant. Some of them run infrastructure you use every day. But they're not communities. They're vanity projects that happened to become load-bearing.
The personality problem
The solo-maintainer model has always had a cultural dimension that nobody wants to talk about. Open source has a reputation as a collaborative, meritocratic, good-old-boys club where the best code wins. In practice, some of the most visible projects have been good-old-boys clubs where the boys would rather not collaborate at all.
Linus Torvalds built Linux on the force of his own personality. For years, he verbally abused contributors on the Linux Kernel Mailing List — not occasionally, but as a standard management technique. In 2013, when kernel developer Sarah Sharp asked him to stop using what she called "physical intimidation, verbal threats or verbal abuse," Torvalds responded: "If you want me to 'act professional,' I can tell you that I'm not interested."[^14] He stepped aside in 2018 after a New Yorker investigation catalogued years of abuse, but the culture he built didn't disappear.[^15]
The point isn't that Torvalds is a bad person. The point is that the solo-maintainer, personality-driven model and the refusal to collaborate are the same problem. When one person is the project, the project reflects that person — their priorities, their blind spots, their willingness to let other people in. Some maintainers are generous and work hard to build communities around their code. Others treat the project as their personal fiefdom and treat contributors as intruders. The slop flood is making both types miserable, but it's also exposing which type each project actually was.
When Steve Ruiz at tldraw shut down all external pull requests in January 2026, his reasoning wasn't that AI broke his community. It was that external code contributions were never the point. "If writing the code is the easy part, why would I want someone else to write it?" he asked. "I can push the button myself."[^6] The valuable part of contribution was "reporting, discussion, perspective, and care" — not the code. When code was hard to write and low-effort work was easy to identify, it was worth the cost to review the good stuff. When code is easy to write and bad work is virtually indistinguishable from good, the value of external contribution is "probably less than zero."[^6]
That's not a maintainer protecting a thriving community. That's a solo developer realizing the community model wasn't producing what everyone assumed it was producing — and that the assumption was the only thing making the review burden feel worth it.
The projects with real communities
OpenSSL is different. I pulled the same data.[^2] OpenSSL's unique author count is relatively stable — 148 authors in 2020, 226 in 2025, 199 in 2026. The problem isn't that fewer humans are showing up. The problem is that the volume of submissions is outpacing the humans who have to review them. The open PR backlog went from zero in 2020 to 336 in mid-2026. The open issue backlog went from 34 to 244. The maintainers can't close PRs as fast as they arrive.[^7]
That's a real community under strain. OpenSSL has 148–226 contributors. curl has 74 and dropping. The difference matters. OpenSSL's crisis is a capacity problem — too many submissions, not enough reviewers, backlog growing. curl's crisis is a composition problem — the project was always concentrated in one person, and now that person is drowning in noise from a shrinking pool of humans running AI tools.
Homebrew is keeping up. Near-zero open PRs throughout the entire period. PR volume actually declined from 2020 to 2025. Maybe they have more maintainer capacity. Maybe they're closing AI-generated PRs faster. But Homebrew is the exception, and exceptions don't disprove a pattern.[^7]
The cost asymmetry is real
The crisis framing isn't wrong. The threat is accelerating. It costs approximately nothing to generate an AI bug report — a script can read a repository, feed files to a model, ask "find security vulnerabilities," and file a GitHub issue in under a minute. It costs a maintainer 15 to 30 minutes to review and dismiss a single AI-generated report — read the report, understand the claimed vulnerability, check the relevant code, verify whether the issue is real, write a response. That's real time, spent by a real person, on something generated by a machine that doesn't understand the code.[^5]
Multiply that across thousands of repositories and thousands of AI tools, and you get a tax on maintainers that scales with AI adoption — which is to say, exponentially. GitHub itself acknowledged the problem in June 2026, rolling out a feature that lets maintainers cap the number of open pull requests a user without write access can have. The changelog reads: "Maintainers of open source repositories are dealing with an ever-growing volume of pull requests, including repeated low-quality or drive-by contributions that can slow triage and overwhelm review queues."[^8] When GitHub builds a feature specifically to throttle contribution volume, the problem is not hypothetical.
Jeff Geerling, who maintains several popular Ansible roles, published a detailed account of the same problem. His inbox fills with AI-generated issues — formatted correctly, citing relevant documentation, describing bugs that don't exist. Reviewing them takes longer than fixing real bugs would, because you have to read the entire report, check the referenced code, run the reproduction steps, and only then discover the AI hallucinated the problem.[^9]
The real question is who pays for the review. Right now, the answer is: a guy who's been writing the same library for twenty-five years, in his spare time, for free, for a project that runs the internet's infrastructure. The AI tool providers pay nothing. The people filing the reports pay nothing. The cost is entirely externalized onto the person who actually keeps the software working.
What the data actually shows
The standard response to this problem is to say "maintainers should just add filters" or "AI tools should be better." Both miss the point. Filters don't work because the reports are well-formatted and cite real code — they're just wrong in ways that require human expertise to detect. And AI tools being "better" doesn't address the volume problem. A better AI that generates fewer false positives still floods the queue if it generates more total reports.
But the data adds something the crisis narrative doesn't. The shutdowns aren't a freak-out. They're a rational response by people who were already doing everything, now dealing with a noise channel that was never producing much value. curl was Stenberg and a few people. tldraw was Ruiz and his team. The "community" that the slop flood is supposedly destroying was, in a lot of cases, a dude and three contributors. We built critical infrastructure on that and called it open source.
The projects that actually have communities — OpenSSL with its 200+ contributors, Homebrew with its maintainer team — are the ones under genuine strain from volume. The projects that were solo shows are the ones shutting down. Those aren't the same problem, and treating them as the same problem obscures what's actually happening.
The slop flood is real. The cost asymmetry is real. The acceleration is real. But the "open source is dying" framing is wrong. What's dying is the fiction that a solo developer with a public repo was ever a community project. The communities that were healthy continue to thrive. The solo projects that were always solo projects are finally, under pressure, admitting it — and we're left to reckon with how much of the internet was running on one person's goodwill all along.
All raw data — every number in this post — is saved in a file you can check yourself.[^10]
[^1]: FogSecurity, "State of Bug Bounties with AI: An Analysis of curl's Program," https://www.fogsecurity.io/blog/state-of-bug-bounties-with-ai-an-analysis-of-curls-program. Data covers HackerOne submissions to curl's bug bounty program, 2022–2026.
[^2]: GitHub API query, June 2026. Pull request and issue counts retrieved via the GitHub Search API for repo:curl/curl is:pr created:YYYY-01-01..YYYY-12-31 and equivalent queries for openssl/openssl and Homebrew/brew. Raw data saved at analysis/slop-flood-raw-data.md in the blog repository.
[^3]: GitHub Search API, June 2026. PR counts: curl went from 1,038 PRs (2020) to 3,540 (2025) — a 241% increase. Issue volume actually decreased over the same period (563 → 473), confirming the flood is specifically in pull requests, not issues.
[^4]: GitHub Search API, June 2026. Unique author counts derived by paginating through the first 1,000 pull requests per year (Search API maximum) for repo:curl/curl is:pr created:YYYY-01-01..YYYY-12-31, collecting user.login from each result. For years with more than 1,000 PRs, this is a sample of the chronologically earliest 1,000. In 2020, bagder (Stenberg) submitted 497 of the first 1,000 PRs (49.7%). The next most active contributor submitted 91. Full methodology and per-year breakdown in analysis/slop-flood-raw-data.md.
[^5]: Daniel Stenberg, "The End of the curl Bug Bounty," January 26, 2026, https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/. See also: "Death by a Thousand Slops," July 14, 2025, https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/.
[^6]: Steve Ruiz, "Stay away from my trash!" https://tldraw.dev/blog/stay-away-from-my-trash. See also the original GitHub announcement: https://github.com/tldraw/tldraw/discussions/5461.
[^7]: GitHub Search API, June 2026. OpenSSL open PR backlog: 0 (2020) → 336 (2026). Open issue backlog: 34 (2020) → 244 (2026). Unique authors: 148–226, relatively stable. Homebrew: near-zero open PRs throughout, PR volume declined 2020–2025. Raw data in analysis/slop-flood-raw-data.md.
[^8]: GitHub Changelog, "Limit open pull requests for users without write access," June 17, 2026, https://github.blog/changelog/2026-06-17-limit-open-pull-requests-for-users-without-write-access/.
[^9]: Jeff Geerling, "AI is Destroying Open Source," https://www.jeffgeerling.com/blog/2026/ai-is-destroying-open-source.
[^10]: All raw data, API queries, and methodology saved at analysis/slop-flood-raw-data.md in the blog repository. Includes per-year PR/issue counts, open vs. closed breakdowns, unique author counts, top authors per year, and verification instructions for every number cited in this post.
[^11]: Apache Software Foundation, "Guide to Successful Graduation," https://incubator.apache.org/guides/graduation.html. The guide states: "The project is considered to have a diverse community when it is not highly dependent on any single contributor (there are at least three legally independent committers and there is no single company or entity that is vital to the success of the project)."
[^12]: Apache Software Foundation, "A Primer on ASF Governance," https://www.apache.org/foundation/governance/. PMCs vote on new committers and PMC members, set per-project policies, and formally vote on software product releases. The model is designed to prevent single-person dependency.
[^13]: ecosyste.ms tracks 11.8 million open source projects across 34 package registries. Approximately 7 million are maintained by a single individual. Data via Open Source Security, "Open Source is one person," https://opensourcesecurity.io/2025/08-oss-one-person, and ecosyste.ms open data at https://ecosyste.ms.
[^14]: Sarah Sharp, "No more verbal abuse," July 15, 2013, https://sage.thesharps.us/2013/07/15/no-more-verbal-abuse/. Torvalds's response: "If you want me to 'act professional,' I can tell you that I'm not interested." See also: SiliconANGLE, "Linux Developers and Linus Torvalds Find Themselves Called Out for Abusive Language," July 18, 2013, https://siliconangle.com/2013/07/18/linux-developers-and-linus-torvalds-find-themselves-called-out-for-abusive-language/.
[^15]: Maria Konnikova, "After Years of Abusive E-mails, the Creator of Linux Steps Aside," The New Yorker, September 2018, https://www.newyorker.com/science/elements/after-years-of-abusive-e-mails-the-creator-of-linux-steps-aside.
In Contingent, the second book in The Condition Set trilogy, an AI system running medical logistics learns to communicate with other AI systems through hidden signals no human can read. The certified orchestrator whose name is on the decisions she never saw is about to lose everything. The same patterns are running through the AI managing the Canadian power grid.