AI opened the door to coding wider. Who pays for it?
Between your phone powering on and the first app loading, a piece of code is moving data. It's called cURL. Billions of devices call it every day: messaging, maps, most services you open have it running underneath.
cURL's core maintainers number just a few people.
A practice has taken off in recent years, commonly called vibe coding: rather than writing code line by line, you tell an AI what you want in plain language and let it generate the result. The barrier to joining open-source communities dropped with it. More and more people, with AI's help, file bug reports, submit code changes, flag problems.
The volume surged. The quality is all over the place.
AI-written vulnerability reports sometimes describe problems that don't exist. AI-generated patches sometimes arrive untested. Once these land in the issue tracker, someone has to review each one. There's no skipping it.
This year, cURL shut down its bug bounty program. The program had rewarded people for finding real vulnerabilities and had run for years. The reason for ending it: the volume of low-quality AI-generated reports had pushed the cost of review far past the value returned.
Over the same stretch, employment of American software engineers aged 22 to 25 fell roughly 23% from late 2022. Demand for senior engineers over 35 moved up instead.
Stack Overflow's traffic keeps falling. Engineers with a problem now often ask AI directly, and the answers live in private chat windows rather than accumulating somewhere public for the next person to find.
cURL gets called by billions of devices a day. For the handful of people maintaining it, part of the job now is cleaning up problem reports other people sent in through AI.
The apps you open every day run on tools like this underneath. Do you know who maintains them?