Open source projects have traditionally relied on things like bug bounties, programs where individuals can report bugs in exchange for a monetary prize, to detect security issues in the projects. One such example is Curl, a library with 20 billion+ downloads, used by everyone from individual researchers to large companies. With the advent of AI, the generation of such “bug reports” has become extremely easy, with bad actors submitting multiple reports to bug bounty programs hoping something is valid so they can win money. This has caused an uptick in the number of bug reports received by Curl’s bug bounty program, going from 86 in 2024 to 261 so far in 2026 This places an undue burden on the team of Curl’s maintainers, who thoroughly review each submitted report, given the heavy cost of missing any submitted reports that turn out to be true vulnerabilities. Given the cost of missing a reported vulnerability, the entire vulnerability classification process cannot be automated using AI. Instead, in this work, we explore what AI-assisted tools can we build for Curl’s maintainers that help them determine whether a vulnerability report is an actual vulnerability or not.