Security company AISLE reports that its autonomous AI analysis system found six vulnerabilities in curl that were assigned CVEs in curl 8.22.0, shortly after two frontier AI security tools reportedly found nothing at all.

According to AISLE, curl founder Daniel Stenberg wrote on August 24, 2026 that only three CVEs were pending for the next release, noting that Anthropic Mythos could not find more issues and OpenAI Codex Security showed an empty list. AISLE then ran its system against curl, which the company says produced 29 reports. The next day, Stenberg publicly posted the comparison: Mythos 0, AISLE 29.

Of the 29 reports, six were reviewed by curl's security team within days and accepted as serious enough for public CVE designations in curl 8.22.0: CVE-2026-80229 (OpenSSL provider use-after-free), CVE-2026-80230 (OpenSSL pinning bypass), CVE-2026-80231 (native CA store connection reuse), CVE-2026-80255 (secure attribute bypass with tab), CVE-2026-82208 (wolfSSL CA-cache hit overrides callback) and CVE-2026-82209 (domain-scoped public-suffix cookie).

All six are rated Low severity, which AISLE attributes to curl's engineering maturity: remaining flaws tend to hide in narrow configurations and subtle interactions. All six were fixed in curl 8.22.0 and credit Stanislav Fort of AISLE as reporter. Three were reported on August 24, two on August 26 and one on August 27, 2026. By August 28, curl's pending CVE count had risen from three to ten, six of them from AISLE.

AISLE argues this was a cleaner evaluation than typical AI security benchmarks, since the zero-result baseline was publicly timestamped before its run, and curl's maintainers independently decided which findings were real and CVE-worthy. Greg Kroah-Hartman, maintainer of the Linux stable releases, responded to Stenberg's post that he is seeing the same pattern for Linux. AISLE frames the result as support for its thesis that specialized AI systems can outperform frontier lab models at real-world zero-day discovery.