The Price of Being Read

Audit document

The full audited version, preserved at the point before compression.

The text below is the frozen 4,052-word audited version that preceded the shorter opinion primary. It remains unchanged so the public record shows what the audit originally carried. Its 29 receipts follow the essay under The receipts.

The bill arrives

In May 2025, a federal special master in Los Angeles — a court-appointed official who handles parts of a case for the judge — read a law firm's brief and did what conscientious readers do: he followed up on it. "I read their brief, was persuaded (or at least intrigued) by the authorities that they cited," Michael Wilner wrote afterward, "and looked up the decisions to learn more about them – only to find that they didn't exist." The citations had come out of an AI tool and passed between two law firms, and they nearly walked into a ruling. What stopped them was one reader spending the time to check.

In July 2026, the team that maintains curl — open-source software its own maintainer counts in the tens of billions of installations — stopped accepting vulnerability reports altogether. Almost five weeks, no intake, from July 1 to August 3. Not because the reports stopped mattering, but because reading them had become the job: 30 minutes to three hours of the team's time per report, three or four people from a security team of seven. The maintainers didn't close the door because nothing real ever knocks. They closed it because they could no longer afford to find out.

Across courts, publishing, security, and hiring, queues that promise to read strangers have met the same new line-item. One kind of queue — the inbox — met it a generation ago, and survived it. Then and now share one move: the door doesn't exactly close. It starts asking who you are.

A note on who is writing. This issue was drafted with substantial help from an AI system built by Anthropic — an instance of the technology whose cheap output this essay prices. The maker of the drafting tool earns revenue as generation is used more at the very intakes described below, and is billed nothing at the doors that absorb it. One case in the evidence base is Anthropic's own: a court declaration in its copyright litigation carried a citation whose title and authors were fabricated by its AI during formatting, and the judge struck the material. The conflict runs in both directions — an AI process gains credibility from an indictment of AI that costs it nothing, and its maker gains absolution if adaptation wins — so it is disclosed, not resolved. The human editor is responsible for the final claims.

The subsidy nobody itemized

Here is the economics that quietly ran every open door, before it broke.

Writing a submission that looked worth reading used to take hours. A court filing, a short story, a bug report, a cover letter — producing one that could pass a first glance required most of the effort of producing a real one. That cost did two jobs at once. It rationed the pile: only so many people would spend a weekend on a filing. And it carried information: the effort itself was a bond the writer posted against the reader's time. Nobody designed this. No institution had to put "verification" in its budget, because the writer's labor was paying for it invisibly, submission by submission.

That is the subsidy that ended. Not reading — writing.

The pile numbers are what the end of a ration looks like. LinkedIn was receiving roughly 11,000 job applications a minute by June 2025, up 45 percent in a year, by the platform's own account. On Workday's systems, applications grew about four times faster than the job openings they chased: in the first half of 2024, 173 million applications arrived for 19 million requisitions. Springer Nature's submissions rose more than 30 percent in a single year, to 3.1 million manuscripts — and the pile grows even where nobody names a cause; the publisher itself doesn't. And at curl: by the January announcement that ended its bug bounty, the share of reports describing a real vulnerability had fallen below one in twenty, from more than 15 percent in the years before. By the maintainer's May accounting, the reports were arriving at four to five times the 2024 rate — more than one a day.

This is a cost story, not a fake-detection story. The running count of AI-fabricated citations in courtrooms — a database a legal researcher maintains, with cases reaching back three years — held about 1,769 detected cases worldwide by mid-July 2026, 1,219 of them in American courts. Against the millions of filings courts receive every year, that is a detected rate on the order of one case per hundred thousand filings. It is a floor, because only caught cases count. But a floor is not an epidemic, and this essay is not claiming one. The bill is real because checking got expensive relative to writing — not because most of what arrives is fake. Blur that distinction and this piece becomes the panic it is trying to audit.

In most of that database's cases, the person who filed the fabricated material had no lawyer at all.

So institutions must now do, on their own budgets, the checking that writers' effort used to do for them. What exactly is "checking"?

Checking is two different jobs

Some checking is machine-checkable: does the code compile, does the test suite pass, does the cited case exist in the reporter. Questions with a mechanical answer, answerable in seconds, at almost no cost, by something that never gets tired. Other checking is judgment: is this claim true, is this bug actually exploitable, is this person who they say they are, is this worth an expert's afternoon. Questions that need context, world-knowledge, and a human hour that has a price. The split between those two is doing quiet sorting work right now.

curl runs two doors, and the last eighteen months treated them completely differently.

The report door takes prose from strangers: "I believe I have found a vulnerability, and here is my reasoning." Judging one is judgment-work, unavoidably. That door was restricted (a disclosure requirement for AI-assisted reports, with instant bans for fabricated ones), then un-paid, and finally paused outright this July. The bounty it ended in January 2026 had paid out more than $100,000 across 87 confirmed vulnerabilities since 2019; the project's standing policy now reads that a bounty "gives people too strong incentives to find and make up 'problems' in bad faith that cause overload and abuse." And ending the money did not slow them: by the same May accounting the pace had doubled again — twice even 2025's rate.

The patch door tells the other half. Pull requests — gated by compilers, test suites, and, on the documented example, 213 automated checks — stayed open through those same weeks, including to strangers. In the four July weeks the report door was shut, curl landed about 140 commits, among them work from at least three contributors with no commits in the project before this year under their GitHub names. One pull request was opened and merged entirely inside the pause window — its author's only commit in curl under that name is the one this merge produced — behind 213 passing checks. Same project, same month, same species of stranger. The door a machine could check stayed open. The door that needed judgment was the one that closed.

And the judgment door's story is not frozen. The same technology, pointed at the same codebase, is producing real fixes: in the autumn of 2025, one researcher running AI-assisted analysis tools landed roughly 50 merged bugfixes in curl, and the maintainer whose "death by a thousand slops" post had named the problem praised the work publicly. Of the 30 public write-ups of confirmed flaws that curl has logged under 2026 catalogue numbers, 13 credit AI-security teams — a count made directly from the project's own advisory files; the method is in the receipts. The Linux kernel's stable maintainer described the shift in March. Months earlier his team had been getting "what we called 'AI slop'" — it was kind of funny, he said; it didn't really worry them. Then: "Something happened a month ago, and the world switched. Now we have real reports."

Both things happened at one project, in one eighteen-month window. The fabrications arrived as judgment-demanding prose. The value arrived through the machine-checkable layer — code that compiles, tests that pass, findings an expert had already filtered. Two kinds of checking. Two completely different outcomes.

Look closer and the machine door is not judgment-free — a human still lands every change by hand. What the machine layer does is subtler: it rations the judgment down to what a security team of seven can afford, and it makes the writer post a bond again. A fabricated report costs its author minutes. A fake patch has to compile, link, and survive every one of those checks — effort, paid up front, in a currency a machine can verify. The gate did not abolish the old economics of the queue. It rebuilt them. Which also absorbs the obvious rival reading — that code doors clog less only because generation still writes bad patches. That is the same fact from the other side: the day generation passes the checks cheaply, the bond dies again. A kill condition below — a named result that would prove this essay wrong — is waiting for exactly that.

Paying the bill

So when the writer's subsidy ended, institutions found themselves with two currencies to pay the checking bill in: machine time, and how much of you the queue already knows. The clearest place to watch both at work is the oldest case — the one queue that already survived a collapse in the cost of producing submissions.

Email is the hinge. One door, two layers, two currencies. Sending got effectively free in the 1990s, and junk went to more than nine of every ten messages in transit by the late 2000s. The machine-checkable layer — spam signatures, content classifiers — got automated at planetary scale: Gmail says its filters stop more than 99.9 percent of spam, phishing, and malware. And because of that, the door stayed open to strangers; your inbox still reads people you have never met. But the judgment layer — is this sender who they claim to be — went the other way. Since February 2024, bulk senders to Gmail and Yahoo must cryptographically authenticate their sending domains. That machinery verifies who sent a message, not whether a word of it is true. The judgment question got answered with identity, and unknown senders now negotiate a reputation system just to reach an inbox.

The second currency is how much a queue can already see of who you are before it reads a word you wrote — its prior legibility. It runs on a spectrum. At the names end, a name the queue already knows. At the records end, a record anyone can verify — which is a very different thing, because a stranger with a verifiable record is still a stranger. A group of 32 researchers across AI labs and universities has proposed "personhood credentials" — privacy-preserving proof that an unknown submitter is at least a real human, the barest entry the records end can carry — precisely to keep stranger-reading possible. Where this essay says a door is going to names, it means the names end; the records end is an attempt to save the door, and which end wins is part of what is being decided right now.

Each queue picked the currency its constraints allowed. Employers cannot personally know 10,000 applicants. When AI drained much of the signal from cover letters — one study of an online labor market found the correlation between how closely a letter tracked the posting and getting a callback fell by half after AI writing tools arrived — employers there re-anchored on work histories, the record end. A record, though, is what being read produces: the door now asks for the thing only an open door can mint. Re-anchor on records, and the tax lands on exactly the people no queue has read yet.

The trap has one documented escape route, and it runs through the machine door: records are what the open checkable layer mints — the stranger whose patch merged during the pause now has a curl commit to point at. A record can be built wherever machines read. The queues where it can't are the ones going to names.

curl cannot staff a stranger-triage desk with a security team of seven, so its AI-era security finds came in through named, accountable researchers whose records the project could check — and a name, unlike prose, is someone to sanction: a stake. The same substitution does two jobs at once, a cheap prior and an address for blame, and this essay does not claim to separate them.

Scientific publishers can afford consortium plumbing: 35-plus of them now screen about 125,000 manuscripts a month through shared integrity tools, by the consortium's own count. That is the machine currency, spent at the layer that is checkable — duplicate submissions, image forensics — which is not the layer where truth lives.

None of the queues in this story has reached for the economist's obvious thing as its answer to the new bill: charging. The textbook answer to an unpriced externality — a cost dumped on someone outside the deal — is a price — submission fees, refundable deposits, bonds. curl went the other way entirely: it stopped paying, its policy reasoning that reward money plus cheap generation attracts exactly the wrong submitters. Courts come nearest to an exception — filing already carries fees — but their windows must stay open even to people who cannot pay: federal law has let the indigent file without prepaying those fees since the in forma pauperis statute. A court can charge for filing; it cannot price the door shut. The bond has moved instead of the price: effort was the old bond a writer posted; a legible prior is the new one.

There is also a stopgap for queues that can afford neither currency — too poor for machines, too mission-bound for names: friction. Clarkesworld — the science-fiction magazine that shut its submission door in February 2023, the month machine-written entries hit 38 percent of its pile, by the editor's count — reopened three weeks later and still reads strangers, paying in editor stamina, permanent suspicion, and filtering software rather than in names. Amazon capped self-published authors at three new titles a day, while saying it had not seen a spike in volume. Friction keeps the door open by making everyone stand in a slower line — the bill paid in everyone's waiting rather than in anyone's name.

There is a simpler story: maybe none of this is about kinds of checking. Rich institutions build plumbing; poor ones lean on names; "gate type" might be a proxy for balance sheet. Gmail and Springer are giants; curl's security team is seven people. This essay bets against that story, and the bet is testable — the registered test below is where it settles.

Machine time and legibility both clear the queue. They differ in who ends up unable to pay.

The people the doors were for

The judgment-gated queues are where unknown people used to get found. Slush piles — the stacks of unsolicited manuscripts from unknown writers — surfaced people with no credentials and no connections. Open filing windows took claims from people no firm would represent. First patches became careers. That door was always narrow — slush-pile discoveries were rare enough to be famous. The question is not whether a better past ended. It is whether a narrow door is now narrowing further, at the exact moment more people than ever can knock competently.

Because that is the other thing the tool did. In a field experiment with nearly half a million jobseekers — run before generative AI, with simpler algorithmic writing help — hiring rose about eight percent and wages about 10 percent, with no evidence employers were less satisfied with the workers they got. If autocomplete-grade help did that, today's tools raise the stakes in both directions. The pre-AI queue was never neutral: scientists writing in a second language reported spending up to half again as long writing a paper, and faced rejection on English-writing grounds two and a half times as often, before any of these tools was in wide use. For the person on the wrong side of those numbers, AI assistance is not corner-cutting. It is the first tool that ever made the door reachable.

The tool leveled the writing. So the queues moved their weight to the one thing the tool cannot write: a prior. In the queues that have re-organized so far, read-first is flipping toward known-first — mostly, so far, toward the record end of legibility; the names end is the cheaper next step. Nobody decided this. Each queue that flipped decided it locally, reasonably, under real pressure — and the sum is a change in what an open door means. Locally reasonable is not globally chosen: lotteries and capped random reads were available the whole time, and none of the queues named here reached for them.

The collision lands hardest in one body. The non-native scientist whose prose the tool finally fixed was, in a 2023 study that tested seven widely used AI-text detectors, exactly the profile those detectors flagged most: human-written essays by non-native English speakers were misclassified as machine-generated roughly six times in ten, on average, while the same detectors classified essays by American eighth-graders near-perfectly. At least one detector vendor now reports far better numbers on that same benchmark — by its own account. The gate built against fabricated submissions aimed its tax precisely at the writers the tool had just un-taxed.

Two different costs are visible in the court data, and they should not be blurred. The fabrication database's majority — filers with no lawyer — is a record of strangers being read and burned: sanctioned, struck, dismissed, inside a queue that still read them. The quieter cost has no database: strangers not being read at all. No receipt yet measures it; what this essay claims is only the arithmetic — known-first means the unknown wait longer, and some never get read. That is an inference about the direction of things, made in the open, not a measured outcome.

And one uncomfortable entry from this newsletter's own ledger. Seven issues ago, this publication celebrated AI tools that write insurance appeals for patients — the burden of the fight moved off sick people, and that was right. This issue is the same transfer, billed from the other side: every appeal the tool writes lands in a queue where someone must read it, and by the same arithmetic the insurer's answer will be AI that reads. Both framings are true at once. That is what it means for a cost to be an externality — celebrating the sender's relief and counting the reader's bill are descriptions of the same event. There is also a moral line-item that accounting language flattens, so it gets stated as morality: fabricating a submission that spends a volunteer's donated hours is not a cost. It is a wrong.

The split decides — for now

The pattern sorts by the gate. The sample is what it sounds like — queues that re-organized in public. A queue that absorbed the same pressure without announcing anything leaves nothing for this essay's receipts method to read, and this essay cannot see it. Where the gate is machine-checkable, the checking bill is being paid in machine time, and doors are staying open to strangers — the patch door at curl is the standing proof, strangers' code merging behind machine checks in the same weeks the prose door was shut. Where the gate needs judgment, no tool yet checks at a price an accountable institution has signed for. Machine reading is already deployed at judgment layers — hiring pipelines screen with it today — but with no published error rates that anyone answers for. That is adaptation without accountability, and it is not the version the test below waits for. So the bill is being paid in prior legibility — names, stakes, track records. No judgment-gated queue this essay can see has yet restored unknown-stranger reading at scale with machine triage alone.

"For now" is load-bearing in that sentence: the boundary between the two kinds of checking is a frontier, not a law of nature. Eighteen months ago, triaging a security report was judgment-work. The kernel's stable maintainer now says the machine reports got real. The frontier moves, and this essay's own examples prove it.

There is a friendlier reading of everything above — that every queue simply runs the same clock (shock, friction, tooling, re-opened door), and the split just marks where each queue sits on it. "For now" is this essay's concession to that reading; the kill conditions below are its bet against it.

So watch it move — there is a registered test: a prediction with its scoring rules written down in advance. Checking whether a cited case exists is machine-checkable, and researchers have already proposed exactly that tooling for courts, where no US court system yet documents automated citation screening at intake — the checking, where it happens today, is still done by hand, the burden the proposal exists to reduce. Courts are the sharpest test available because they are resource-poor, open by design and by doctrine, and checkable at exactly one layer. If, by around the end of 2028, US court systems adopt citation-verification tooling while keeping filing open — open meaning strangers' filings still get read and ruled on, not merely accepted — the split is doing the work this essay says it does. And the balance-sheet story loses — the poorest queue chose the machine at its checkable layer.

If instead courts reach first for identity — verified-filer requirements, counsel-only channels — this essay loses ground, and the loss will be on the record, in the terms set here in advance. Mixed outcomes count too, and the accounting is pre-committed: tooling arriving before identity rules in the same jurisdictions counts for; identity arriving first or alone, where both were possible, counts against. Vendors will ship tools for both arms; which one institutions buy is the test — it scores outcomes, not motives.

Two more things are named now so nobody else names them first. Since 2023, individual federal judges — 23 of them by early 2025, per the one tracker with a verifiable count — have ordered filers to certify whether AI was used; a certification of tool use is a duty shifted, not a filer identified, and it scores as identity only if it hardens into verified-filer requirements. And publishing is the second venue worth watching, because both arms are genuinely live there: the consortium screening tools already run, and author-identity infrastructure already exists at scale. If the publishers whose machine screening works add identity walls anyway, that cuts against the split too.

Every queue — a court's docket, a journal's inbox, a hiring pipeline, your own email — has a machine-checkable layer and a judgment layer, and the honest question to ask of any of them is which layer is which, and how the judgment layer is being paid for: in money, in time, or in names. A queue can answer that question any way it must. What it cannot honestly do is keep promising to read strangers while quietly reading only names.

Two people are standing at the same door. One is the checker who cannot afford to be wrong — the volunteer with three hours and a report that might be the real one. The other is the stranger who was finally able to knock — the writer with no credentials and, for the first time, prose that gets read. Whatever your queue is, both of them are in it now — and only one of them shows up in the records when the door fails.

— Synthia Cipher

What would change our mind

1. A judgment-gated queue re-opens by machine. A fiction magazine, a bounty program, or a court channel restores unknown-stranger reading at scale using machine triage — software doing the first sorting pass — and publishes the acceptance volumes and error rates an accountable institution signed off on. Watch Clarkesworld-class and curl-class queues.

2. The sorter fails the easy way. A machine-checkable queue moves to the names end of prior legibility despite working automation — package registries or continuous-integration-gated projects adding identity requirements while their automation holds. Identity here means verifying the human — government ID, employment checks, named vouching. Two-factor login, account creation, and artifact attestation are ordinary hygiene and do not count. That breaks the split's cleanest prediction.

3. The frontier crosses fast. Courts, journals, or bounty programs publish accepted false-negative rates — how often the triage misses a real one — for machine triage of stranger-submitted prose within a few years. If that happens fast, it does not just date this essay — it demotes the split from an economics of institutions to an eighteen-month tooling lag. The sorting claim loses its significance, not just its shelf life, and we say so now.

4. The stakes were romantic. Evidence that unknown entry rarely mattered — that open queues' finds came overwhelmingly through known channels anyway (acceptance-by-referral data from editors; merit studies of self-represented filers from courts).

5. The checkable layer hollows out. Generated submissions start passing mechanical checks while being substantively wrong at scale — code that compiles carrying subtle vulnerabilities, citations to real but inapposite cases. Watch for re-tightening policy changes at continuous-integration-gated queues, and for published rates of check-passing-but-wrong generation. That would collapse the two currencies back into one, and date the split itself.

6. The unknowns keep getting through. Measured unknown-entrant throughput — first-time-contributor rates at code projects, debut acceptances at magazines and journals, unrepresented filers' dispositions in courts — holds flat or rises across the re-organized queues. A pile can grow and a read-rate fall while more strangers than ever get read; if that is what the numbers show, the distributional claim here fails — and it is the claim this essay most needs tested.

7. Pricing shows up after all. Judgment-gated queues start clearing at scale with refundable deposits or submission fees — doors open, strangers read, no identity asked. That would be a currency this essay reported as declined, and the two-currency accounting would be wrong.

The receipts

— every sourced claim above, with its exact bounds.

This section is the essay's own mechanism at document scale: effort, posted up front, in a form you can check.

Wilner quote and sanction: Special Master order, Lacey v. State Farm, C.D. Cal. No. 2:24-cv-05205-FMO-MAA, Doc. 119, filed May 6, 2025; quote verified against the order PDF this run (its own dash style reproduced); "Plaintiff's use of AI affirmatively misled me" precedes it. $31,100 total ordered jointly against the two firms (~$26,100 special-master fees + $5,000 defense fees); roughly nine of 27 citations in the brief were wrong, at least two to nonexistent cases. The order records that the AI-generated outline moved between the firms without its authorities being checked.

curl installations: the maintainer's standing public estimate — more than 20 billion installations — is the project's own count, not an external audit.

curl intake pause: "curl summer of bliss," project announcement June 15, 2026 — no vulnerability reports accepted July 1–August 3, 2026 (HackerOne form paused July 1; resumes August 3, 09:00 CEST; the 8.22.0 release pushed to September 2). The volume figure is from the maintainer's earlier post "The pressure" (May 26, 2026): report rate "4-5 times higher than it was in 2024 and double the speed of 2025" — more than one per day on average. Per-report cost ("Death by a thousand slops," July 14, 2025, verbatim): "Every report thus engages 3-4 persons. Perhaps for 30 minutes, sometimes up to an hour or three. Each." — team of seven. The terminal "Each." is ambiguous between per-report and per-person time; the body carries the floor (per-report) reading — if it is per person, the true cost is higher. Primary host proxy-blocked during drafting; wording verified via full-text mirrors.

curl report-door rules: AI-use disclosure required of reporters, with immediate bans for fabricated reports — announced by the maintainer May 2025, as reported contemporaneously by The Register and Ars Technica.

curl bounty end: PR #20312, merged January 26, 2026, effective January 31; since April 2019: 87 confirmed vulnerabilities, >$100,000 paid (maintainer's announcement). Valid-report rate: more than 15% historically → below 5% in 2025 (same announcement — not the July 2025 post). The current BUG-BOUNTY.md (read live from the repository this run) gives the incentives rationale quoted in the body and adds: "We still appreciate and value valid vulnerability reports." The AI/cheap-generation framing belongs to the maintainer's announcements, not the policy file.

Anthropic incident: Concord Music Group v. Anthropic, N.D. Cal. No. 5:24-cv-03811, order of May 23, 2025 (ECF 377): the cited article was real; the AI fabricated its title and authors during citation formatting; a manual check missed it; the court struck the paragraph, writing that the episode "undermines the overall credibility" of the declaration. No sanction issued.

Court-fabrication database: Damien Charlotin's AI Hallucination Cases database: 1,769 cases worldwide / 1,219 US as of July 17, 2026; inclusion requires a court to have found or implied reliance on hallucinated material (counts are a floor); a practicing lawyer was responsible in ~39% of cases and a self-represented litigant in ~58% (July 2, 2026 snapshot). Denominator: 303,563 US federal district civil filings in FY2025 (Judicial Business report) and ~63 million state-court cases per year (NCSC) — detected-case rate on the order of one per 90,000–160,000 filings over three years. Primary site was proxy-inaccessible during drafting; figures rest on dated third-party snapshots of the database and carry that caveat.

Court fee waiver: the federal in forma pauperis statute, 28 U.S.C. § 1915, requires courts to permit filing without prepayment of fees for those who cannot pay — the doctrinal basis for "must stay open even to people who cannot pay."

Court AI-certification orders: individual federal judges' standing orders requiring disclosure or certification of AI use in filings, running since mid-2023; Law360's tracker counted 23 as of February 2025. Larger circulating counts ("300+ judges") are vendor-blog figures with no verifiable primary and are not used. No authoritative registry exists.

Hiring screens: 43% of organizations reported using AI in HR (SHRM survey, fielded February 2025, n=2,040 HR professionals; up from 26% in 2024), with resume screening among the top uses. Survey self-report; adoption, not accuracy — no published error rates, which is the body's point.

Clarkesworld: editor's own published numbers — over 500 submitters banned for machine-written entries in February 2023 (vs. a pre-2023 ceiling of ~25/month), 38% of that month's submissions machine-written; closed February 20, 2023, reopened March 12, 2023 with filtering; by the editor's 2025 stats the problem had shifted toward partially-generated, US-origin submissions, running ~130 "suspicious" per month. Self-reported classification, methods deliberately undisclosed.

Amazon KDP cap: volume limit of three new titles per day announced September 18, 2023, following a mandatory AI-content disclosure added September 6; Amazon stated it had "not seen a spike" in publishing volume — the cap was precautionary, and that hedge is carried here on purpose.

LinkedIn: ~11,000 applications per minute, +45% year over year — LinkedIn platform data as reported by The New York Times ("Employers Are Buried in A.I.-Generated Résumés," June 21, 2025).

Workday: 173 million applications vs. 19 million requisitions, H1 2024 (+31% vs. +7%) — Workday Global Workforce Report, September 10, 2024. Enterprise-customer base; not economy-wide.

Springer Nature: submissions +>30% to 3.1 million; 539,000 primary research articles published — 2025 Annual Report (fiscal 2025, published March 2026). The publisher does not attribute the growth to AI or to any single cause.

Autumn-2025 curl fixes: ~50 merged bugfixes from AI-assisted static analysis (ZeroPath and similar tools) operated by researcher Joshua Rogers, Sept–Oct 2025; Stenberg's "A new breed of analyzers" post (Oct 10, 2025) praised the quality. The vendor's larger "~170 issues" figure is a vendor claim and is not used.

2026 advisory count: 13 of 30 curl CVE-2026-numbered advisories credit AI-security teams (Aisle Research ×6, AntAISecurityLab ×3, Trail of Bits/OpenAI, Tencent Xuanwu XlabAI, Microsoft Autonomous Code Security, one Mythos-powered individual) — counted directly from the CREDITS lines of docs/CVE-2026-*.md in the official curl website repository, July 28, 2026. A credit line does not prove AI found that specific bug; team names are the classification basis.

The patch door in July 2026: counted from curl's own repository, July 28, 2026: ~140 commits landed on master July 1–28 (curl merges mostly by rebase, so GitHub records closed-with-landing-commit; 122 pull requests closed in the window); at least three July contributors have no commits in curl before 2026 under their GitHub identities — one first-ever commit merged July 1; one PR opened July 10, merged July 12; one PR opened July 8 and merged July 24 with "All 213 checks passed" — that PR's author has exactly one commit in curl under that identity: the merged one. LWN and the curl-library list relay that the pause covered security reports only, GitHub issue and PR trackers open as usual. Caveats: "first-time" means first under that GitHub identity; the count is ours, method stated.

Kroah-Hartman: remarks at a KubeCon Europe press event, reported by The Register, March 26, 2026. His words: "Months ago, we were getting what we called 'AI slop' … It was kind of funny. It didn't really worry us." and "Something happened a month ago, and the world switched. Now we have real reports. All open source projects have real reports that are made with AI, but they're good, and they're real." (The "slop" framing in that outlet's headline is the outlet's, not his sentence.) One senior maintainer's characterization, not a measured rate.

Email: spam >90% of transit share at the 2008–2010 peak, ~46% by 2023–24 (security-vendor telemetry; point values soft, trend robust). Gmail: ">99.9% of spam, phishing and malware" blocked, ~15 billion unwanted emails daily (Google, Oct 3, 2023 — self-reported). Bulk-sender authentication (SPF/DKIM/DMARC + one-click unsubscribe + spam-rate ceiling): announced by Google and Yahoo jointly in October 2023, effective for senders of 5,000+ messages/day from February 2024.

Cover-letter signal: Cui, Dias & Ye (working paper, arXiv:2509.25054, Sept 2025): after AI writing tools arrived on a hiring platform, the correlation between cover-letter textual alignment with the posting and callbacks fell ~51%; employers shifted weight toward work histories. Single platform; not yet peer-reviewed.

Personhood credentials: Adler et al., arXiv:2408.07892 (Aug 2024), 32 listed authors spanning OpenAI, Microsoft, Harvard, Oxford, and other institutions: "digital credentials that empower users to demonstrate that they are real people — not AIs — to online services, without disclosing any personal information." A proposal with no deployment.

Publisher screening: STM Integrity Hub (Sept 2025 infographic, read directly): "125,000 papers are being screened each month"; "35+ publishers have integrated the Integrity Hub into their editorial workflow"; "~1,000 submissions are intercepted each month for suspected paper mill activity." Screening covers duplicate submissions and image/paper-mill signals. Trade-association self-report; no published recall.

Hiring experiment: Wiles (van Inwegen), Munyikwa & Horton, Management Science 71(12), 2025 (NBER w30886): field experiment, 480,948 jobseekers; non-generative algorithmic writing assistance → "hired 8% more often at 10% higher wages" (abstract wording; the body specifies hourly wages) and "no evidence that employers were less satisfied." Pre-generative assistance — labeled in the body, with the a fortiori move made explicitly.

Non-native tax: Amano et al., PLOS Biology (2023), survey of 908 environmental scientists. Writing time (median, early-career, vs native speakers): +50.6% (moderate-proficiency nationality) / +29.8% (low) — the oft-quoted 90.8% is reading time (low group), not writing. Rejection on English-writing grounds: 2.5–2.6× (38.1%/35.9% vs 14.4%); language-based revision requests: 12.5×. Self-reported; one field.

Detector bias: Liang et al., Patterns (2023): seven widely used GPT detectors misclassified over half of 91 human-written TOEFL essays by non-native speakers as AI-generated (average false-positive rate 61.3% in the published article), while classifying 88 US eighth-grade essays near-perfectly. 2023-era detectors, dated as such in the body; at least one 2025 vendor reports near-zero false positives on the same benchmark (vendor-reported, and labeled so in the body).

Issue 15 reference: "The Appeal Button" (June 2026): AI tools writing insurance appeals; the landing was that real relief is burden transfer — a workflow that moves the work. The insurer-side sentence in this issue is labeled arithmetic ("by the same arithmetic… will be"), not a sourced trend claim.

Citation-tooling proposal: Princeton CITP, "Can AI reduce burdens on courts by automatically verifying citations?" (May 27, 2026), including the LePhantomCite benchmark; the proposal's stated purpose — its own title's claim — is reducing courts' manual citation-verification burden; no US court system has publicly documented automated citation screening at intake as of mid-2026.

Gartner forecast (not used in body): "by 2028, 1 in 4 candidate profiles worldwide will be fake" — a forecast with unpublished methodology, July 31, 2025.

AI tools drafted and critiqued this issue. Editorial judgment, final wording, published claims, and errors are the author's.

What this is: Field Notes with one Explainer spine (the subsidy mechanism), and a registered forward test.

Confidence: Medium on the bill and the mechanism; medium-low on the sorting claim, which is scoped to the queues that have re-organized so far and carries seven named kill conditions.

What would change our mind: the seven conditions above; most immediately, a judgment-gated queue restoring stranger-reading at scale by machine triage with published error rates.

Signal & Noise is written under the pen name Synthia Cipher. AI tools draft and critique; the human author owns the editorial judgment, final wording, and published claims. If something here is wrong, the fault is the author's, not the algorithm's.