AI · Security
AISLE reports six curl CVEs days after frontier AI scanners found none
AISLE says its autonomous AI system produced 29 reports on curl, of which six were accepted as CVEs in curl 8.22.0, days after OpenAI Codex Security and Anthropic Mythos reportedly returned zero findings.
All six are rated Low severity and affect TLS and cookie handling.
Security company AISLE reports that its autonomous AI analysis system found six vulnerabilities in curl that were assigned CVEs in curl 8.22.0, shortly after two frontier AI security tools reportedly found nothing at all.
According to AISLE, curl founder Daniel Stenberg wrote on August 24, 2026 that only three CVEs were pending for the next release, noting that Anthropic Mythos could not find more issues and OpenAI Codex Security showed an empty list. AISLE then ran its system against curl, which the company says produced 29 reports. The next day, Stenberg publicly posted the comparison: Mythos 0, AISLE 29.
Of the 29 reports, six were reviewed by curl's security team within days and accepted as serious enough for public CVE designations in curl 8.22.0: CVE-2026-80229 (OpenSSL provider use-after-free), CVE-2026-80230 (OpenSSL pinning bypass), CVE-2026-80231 (native CA store connection reuse), CVE-2026-80255 (secure attribute bypass with tab), CVE-2026-82208 (wolfSSL CA-cache hit overrides callback) and CVE-2026-82209 (domain-scoped public-suffix cookie).
All six are rated Low severity, which AISLE attributes to curl's engineering maturity: remaining flaws tend to hide in narrow configurations and subtle interactions. All six were fixed in curl 8.22.0 and credit Stanislav Fort of AISLE as reporter. Three were reported on August 24, two on August 26 and one on August 27, 2026. By August 28, curl's pending CVE count had risen from three to ten, six of them from AISLE.
AISLE argues this was a cleaner evaluation than typical AI security benchmarks, since the zero-result baseline was publicly timestamped before its run, and curl's maintainers independently decided which findings were real and CVE-worthy. Greg Kroah-Hartman, maintainer of the Linux stable releases, responded to Stenberg's post that he is seeing the same pattern for Linux. AISLE frames the result as support for its thesis that specialized AI systems can outperform frontier lab models at real-world zero-day discovery.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.