For two years the incentive was to be first: first to ship the new model, the new framework, the new agent. This summer a different instinct surfaced across the industry, quietly, in three places that have nothing to do with each other. Put them side by side and they tell one story — and it's a story founders should build on.
1. curl took the month off from being attacked by robots#
What happened. On June 15, curl's creator Daniel Stenberg announced a "summer of bliss": for the entire month of July 2026, the project would stop accepting vulnerability reports altogether. Not triage them slower — close the intake form. Submissions resume August 3, and the pause pushed the curl 8.22.0 release back two weeks to September 2.
The cause is now a familiar villain. AI-generated "slop" bug reports — plausible-looking, confidently wrong — flooded curl's security queue at 4–5× the 2024 volume, more than one a day. Earlier this year the project had already shut down its six-year-old bug bounty (87 real vulnerabilities confirmed, over $100,000 paid) after the genuine-vulnerability rate cratered below 5% in 2025. It recovered toward 15% in 2026 as the models got better — but the sheer volume doubled, so the humans lost anyway. curl isn't alone: the libexpat maintainer announced a parallel pause at the same time.
Why it matters. This is the hidden invoice for cheap AI. The tokens are nearly free; the expensive part is the human hours spent deciding whether the machine's output is real. A one-person maintainer team is the canary — but every founder shipping AI-assisted work is paying a smaller version of the same triage tax.
The tokens are nearly free. The expensive part is deciding whether the machine's output is real.
2. A veteran went back to Rails and called it a relief#
What happened. In March, engineer Mark Round published "Returning to Rails in 2026" — a developer who'd spent a decade-plus in infrastructure and DevOps coming back to a framework he'd left around the Rails 3 era. The post went to the top of Hacker News. His verdict: Rails 8's no-build front end (Hotwire, no npm/webpack pipeline), its Solid libraries (queue, cache, and cable that run on the database instead of a Redis fleet), SQLite in production, and Kamal for deploys added up to something he hadn't felt in years — a stack he could hold in his head and run without a platoon.
Why it matters. The reaction was the story. Thousands of engineers recognized the fatigue of fashion-driven stack churn — rewriting the same CRUD app every eighteen months to keep up with the JavaScript meta. "Boring" stopped being an insult. For a founder, maintainability is quietly turning into a moat: the team that isn't rewriting its foundations is shipping features.
3. The trust numbers finally moved#
What happened. Stack Overflow's 2025 Developer Survey, out December 29, caught the mood in hard numbers. AI adoption kept climbing — 84% use or plan to use AI tools. But for the first time, trust fell: developers who distrust the accuracy of AI output jumped from 31% to 46% in a single year, against just 33% who trust it. Overall favorability slid from ~72% to 60%. The single most-cited frustration, named by 45%: "AI solutions that are almost right, but not quite."
Why it matters. "Almost right" is the exact failure mode that makes the other two stories make sense. It's why curl's queue is unmanageable and why boring, verifiable foundations suddenly feel valuable. The market is repricing fast against correct, and correct is winning back some ground.
What to do with this#
This isn't a call to unplug the AI. Adoption isn't reversing, and it shouldn't. The move is to point it differently.
- Verify cheaply, or don't ship it. Use AI hardest where a wrong answer is caught in seconds — tests, scaffolding, throwaway spikes. Slow down where "almost right" is expensive: auth, money, data migrations.
- Own your deploy and your data. The durable-stack crowd isn't anti-cloud for ideology; they want a system they can still run when a vendor pivots or triples the price. Fewer rented dependencies you can't replace.
- Count the triage tax. Every AI-generated PR, report, or draft costs a human the time to check it. If your process assumes that time is free, you're accruing curl's problem at small scale.
- Pick foundations for 2028, not for the demo. The question isn't "what's newest" — it's "what will I still understand and afford to maintain in two years."
We built this week's cluster to be actionable, not just observational: a step-by-step durable Rails 8 + SQLite MVP with no build step, and a tool highlight on Kamal, the deploy-to-your-own-server tool at the center of the boring-stack revival. The pendulum is swinging back toward durable. You can either wait for the consensus or get there first.
