AISLE found six curl CVEs after Anthropic and OpenAI tools found none

AISLE, a security startup, published a blog post on 2 September saying its AI system found six CVEs in curl after Anthropic's Mythos model and OpenAI's Codex Security were reported to have found zero additional bugs in the same code a week earlier.

What was tested

The target was curl, which the post says runs in more than 20 billion installations. AISLE ran its system against the production source rather than a benchmark harness. The curl maintainers independently reviewed each finding and decided which ones qualified as CVEs. All six that qualified were fixed in curl 8.22.0, and the credit line in the release notes reads Stanislav Fort, AISLE.

The timeline

Daniel Stenberg, the curl founder, wrote on 24 August that only three CVEs were pending against curl and that Anthropic's Mythos and OpenAI's Codex Security had found no new bugs. AISLE says it filed 29 reports in total, with three sent on 24 August, two on 26 August, and one on 27 August. By 28 August, Stenberg posted that curl's pending CVE count had risen from three to ten, and six of those ten came from AISLE.

What the six bugs are

All six were rated Low severity by the curl team. They cover an OpenSSL provider use-after-free, an OpenSSL certificate pinning bypass, a native CA store connection reuse issue, a cookie secure-attribute bypass triggered by a tab character, a wolfSSL CA cache path that overrides a callback, and a domain-scoped public-suffix cookie. None is a remote code execution or a memory-corruption bug in the parser.

The caveat everyone should keep in mind

There is one weakness in this comparison, and the AISLE blog does not describe it directly. Anthropic and OpenAI have not published matching write-ups of the same runs, so the claim that their systems returned nothing rests on a report from the curl maintainer rather than on a published log from either company. Commenters on the Hacker News thread, where the post reached 94 points in under three hours, also pointed out that all six CVEs are Low severity, which is where reporting thresholds start to matter.

AISLE also notes that Greg Kroah-Hartman, the Linux stable kernel maintainer, has told the company he sees the same pattern on the kernel. That is a second data point, from a different codebase, but it is again a private observation rather than a public benchmark.

The story is worth reading even if the exact numbers get revised, because it is one of the first cases where a general-purpose AI auditor found real bugs in code that had a decade of review. One useful response is to ask the same question of whatever tool you have already integrated into your review pipeline: what has it found in code that other reviewers have already read, and how many of those findings did the maintainers accept.

The other thing to notice is what did not happen. None of the six CVEs is a full compromise. A team that treats Low severity findings as no action needed learns little from this run. A team that patches everything learns that the auditor is worth keeping. The judgement about which of those two positions fits your product belongs to the team that owns the code.

Source

• AISLE Discovered Six Curl CVEs After OpenAI and Anthropic Found Zero, AISLE blog, 2 September 2026
• Hacker News discussion