AISLE has turned a public zero-result from OpenAI and Anthropic into a sharp test of what specialised AI security systems can actually find. The startup says its autonomous system reported 29 potential curl vulnerabilities; curl maintainers reviewed six within days and assigned them CVE identifiers in curl 8.22.0. AISLE’s account of the findings says the comparison began after curl founder Daniel Stenberg reported that Anthropic’s Mythos and OpenAI Codex Security had found nothing further in one of the world’s most heavily audited codebases.
The accepted findings are all rated low severity, but they are not hypothetical benchmark answers. They include an OpenSSL provider use-after-free, an OpenSSL pinning bypass, native CA-store connection reuse, a secure-attribute bypass involving tabs, a wolfSSL CA-cache issue and a public-suffix cookie flaw. The maintainers fixed all six in curl 8.22.0, which users should treat as the practical endpoint of the story.
Curl’s importance makes the result unusually useful. The project is embedded in everything from consumer devices to spacecraft, and its narrow configuration paths are exactly where generic code review can struggle. AISLE says three reports were filed on August 24, two on August 26 and one on August 27; by August 28, the project’s pending CVE count had risen from three to ten.
Unique insight
The meaningful breakthrough isn’t that an AI found six low-severity bugs; it’s that production maintainers validated a specialised system against a timestamped frontier-model baseline.
Analysis
That changes the near-term security workflow: teams should stop asking which general model is smartest and start measuring which system produces reproducible findings in their own code, with maintainers or security engineers acting as the final judge. The result doesn’t prove AISLE will outperform OpenAI or Anthropic across every repository, and the company’s commercial interest matters, but six accepted CVEs are stronger evidence than a leaderboard. Watch whether Linux and other mature projects report a similar gap, and whether downstream distributions ship curl 8.22.0 quickly.
Bottom line — If I only remember one thing tomorrow, what should it be?
Six independently validated curl CVEs show that specialised AI auditing can uncover real defects that broad frontier systems may miss, even in mature infrastructure.
- Story type: Breaking news
- Impact: High
- Confidence: Medium (multiple reports)
- Audience: Developers
- What changed: Curl 8.22.0 fixes six low-severity vulnerabilities reported by AISLE after OpenAI and Anthropic systems found none in the same codebase.
- What to watch: Whether Linux and other mature open-source projects reproduce the same specialised-system advantage.
- Reading time: 2 minutes
