# Confident report, no reproducible artifact Part of [The AI Tells Index](https://feedsquad.com/ai-tells). A tell signals low effort. It does not identify an author. Skilled writers produce every shape listed here, some of them daily, and automated detectors misread those writers for it at rates measured above 60 percent on non-native English prose. Nothing in this index proves that a machine wrote anything. Read an entry as one piece of evidence to weigh against the false-positive notes printed beside it. ## Facts - Id: irreproducible-confident-report - Category: Semantic (semantic) - Subcategory: factual-failure - Also known as: well-formatted nothing, bug report that does not reproduce - Status: Active. Currently signals low-effort writing. - Severity: high - Evidence grade: corroborated (named independently by multiple credible secondary sources) - Languages: en - Added: 2026-08-15 - Updated: 2026-08-15 - Page: https://feedsquad.com/ai-tells/irreproducible-confident-report ## Description A technical report with every section in the right place, describing something that does not happen. Steps to reproduce that reproduce nothing. A severity rating for a condition nobody can trigger. ## Why it reads as machine-written Report structure is a template and the artifact is not. The structural analogue of the fake citation: correct form, missing referent. The curl project closed its bug bounty programme in January 2026 under a flood of machine-written submissions, and the press account records that in the final week none of the reports described a real vulnerability. The cost of this tell falls entirely on reviewers, which is the asymmetry that makes it worth cataloguing: minutes to produce, hours to refute. ## Detection Type: judge (a rubric for a lightweight model judge) Rubric for a lightweight model judge: ```text Task: decide whether the report contains anything a reviewer could run. Step 1. Check for an artifact. Score each present or absent: a script, payload or input file; a capture or log; a stack trace or crash dump; the exact version and build; the environment, including operating system and compiler or runtime; a repeat count across runs. Step 2. Check internal consistency. Does the described mechanism produce the described symptom? Does the severity rating follow from the described impact? Step 3. Check specificity. Are line numbers, function names and version boundaries given, and do they exist in the code as published? Escape hatches: reports under embargo that say so and offer the artifact privately; environment-specific issues where the reporter states the environment and the limits of what they can share; first-time reporters asking a question rather than asserting a finding; reports about closed-source systems where an artifact cannot be shared. Decision. FLAG when the report asserts a confirmed vulnerability or defect while missing an artifact, a version and an environment. Return the missing fields as a checklist the reporter can complete. Output: the artifact scorecard, the missing fields, and FLAG or PASS. A report with no artifact is unactionable, which is a statement about the report and not about the person who filed it. ``` ## Examples Constructed specimens. Written for this index. Never quoted from anyone's posts. ### Specimen 1 Before, exhibiting the tell: > Steps to reproduce: send a request with a malformed Host header. The parser dereferences a null pointer and the process exits. Impact: remote denial of service. Severity: high. After, repaired: > Steps to reproduce: on version 4.2.1 built with the flags in the attached log, run the attached script, which sends 200 requests with an empty Host header. The process exits on request 137 in three runs out of three. Core dump attached. On 4.1.9 it does not happen, so the change is somewhere between those two tags. Note: Versions and counts in this repair are invented for the specimen. The repair adds an artifact, a version boundary and a repeat count, which is what makes a report actionable. ## False positives Who legitimately writes this way. Novice security researchers file honest false positives constantly, and a programme that punishes them stops hearing from the people who later find real things. Bugs are also environment-specific in real cases: a race condition that appears on one scheduler, a fault that needs particular hardware, a failure that only shows under load nobody else can generate. Reporters working on closed systems cannot always share an artifact, and reporters in some jurisdictions have legal reasons to be careful about what they attach. The rubric therefore produces a checklist of missing fields rather than a verdict, because a report that becomes actionable after one more round was worth the round. ## Model attribution Undocumented per vendor. The reports in the documented case were submitted through a public programme and no tool was identified. ## Sources 1. The Register, curl shutters bug bounty program to stop AI slop https://www.theregister.com/security/2026/01/21/curl_shutters_bug_bounty_program_to_stop_ai_slop/5063039 (tier: press; accessed 2026-08-14) 2. BleepingComputer, curl ending bug bounty program after flood of AI slop reports https://www.bleepingcomputer.com/news/security/curl-ending-bug-bounty-program-after-flood-of-ai-slop-reports/ (tier: press; accessed 2026-08-14) ## Status history Ids are permanent. A retired tell keeps its id and its page. - 2026-08-15, Active: A widely reported programme closure in January 2026, covered by two independent outlets, with the maintainer describing a flood of machine-written reports. Rates circulating with that story could not be confirmed in the cited coverage and are not used here. ## License CC BY 4.0. https://creativecommons.org/licenses/by/4.0/ Attribution: The AI Tells Index, feedsquad.com/ai-tells Reuse the data, including commercially. Keep the attribution line. --- Dataset version 1.0.0. Schema version 1. Part of [FeedSquad](https://feedsquad.com). Built by [Herman Foundry](https://hermanfoundry.com) from Levi, Finnish Lapland.