AI Found 6 curl CVEs Where Frontier Labs Found Zero — and the Baseline Was Public

The debate over whether AI can do real security research usually stalls on the same problem: benchmarks can leak into training data, and vendors grade their own homework. A result published September 2 by AI security company AISLE is worth attention precisely because it sidesteps both problems — the baseline was published by a third party before AISLE ran, and the accept/reject decisions were made by curl’s own maintainers, not by the vendor.

The short version: on August 24, 2026, curl founder Daniel Stenberg publicly posted that Anthropic’s Mythos “can’t find any more” and OpenAI’s Codex Security “shows an empty list” against the curl codebase. AISLE then ran its autonomous analysis system against the same code. Stenberg’s next-day post: “Mythos: 0 — Aisle: 29.” Of those 29 reports, curl’s security team reviewed and accepted 6 as CVEs, all fixed in curl 8.22.0, released September 2.

The Six CVEs

All six are credited to Stanislav Fort (AISLE), rated Low severity, and fixed in 8.22.0:

CVE-2026-80229 — OpenSSL provider use-after-free
CVE-2026-80230 — OpenSSL pinning bypass
CVE-2026-80231 — native CA store connection reuse
CVE-2026-80255 — secure attribute bypass with tab
CVE-2026-82208 — wolfSSL CA-cache hit overrides callback
CVE-2026-82209 — domain-scoped public-suffix cookie

The reports landed on August 24 (three), August 26 (two), and August 27 (one) — inside a nine-day window before release. Stenberg’s pending-CVE count went from three on August 24 to ten by August 28, with six of the ten coming from AISLE.

The low severity ratings deserve a careful read rather than a dismissal. curl is one of the most heavily audited codebases in existence — 188 published CVEs, deployed in over 20 billion instances. What remains unfixed there tends to hide in narrow configurations and subtle interactions (a wolfSSL cache path, a public-suffix cookie edge case), which is exactly where exploitability is smallest and discovery difficulty is highest. Low severity in curl is not low difficulty.

Why the Methodology Is the Story

Most “AI finds vulnerabilities” claims fail on one of two counts: the target may be in the model’s training data, or the scoring is internal to the vendor. This one avoids both:

The zero-result was public and timestamped before AISLE ran. Stenberg’s August 24 Mastodon post established, in public, what Mythos and Codex Security had and hadn’t found. There is no way to retrofit a baseline.
curl’s maintainers, not AISLE, decided what counted. Each finding had to be reproduced, judged real, judged CVE-worthy, patched, and shipped. A CVE is an imperfect metric, but it is external validation: previously unknown flaws in production code accepted by domain experts with no stake in the vendor’s marketing.

This is not AISLE’s first result of this shape — the company is credited in curl 8.18.0 (5 CVEs) and the January OpenSSL release (12 of 12 advisories) — but it is the cleanest head-to-head comparison yet, because the competitors’ zero was published first.

The Frontier-Lab Zero: an Honest Data Point, Not an Embarrassment

Reading Mythos’s zero as “Anthropic’s model is bad at security” misses what the zero actually documents. In May, Stenberg had already reported that a Mythos scan of curl produced one surviving Low CVE. A zero on a second pass is the expected behavior of a system whose highest-severity findings have already been harvested: curl’s residual defects are, by definition, the ones its existing process didn’t catch — narrow, interacting, configuration-dependent.

The interesting signal is the delta, not the absolute: a specialized multi-agent system designed end-to-end for vulnerability discovery produced 29 accepted-for-review findings on code where two frontier models’ security passes had just come back empty. That is an argument AISLE has been making explicitly under its “System over Model” thesis: cyber reasoning is a multi-phase pipeline, and systems purpose-built for it can beat general frontier models — even very good ones — on this specific task. The result supports that thesis; it does not prove it in general, one codebase and one system at a time.

The Linux Signal

The most consequential paragraph in AISLE’s post isn’t about curl. Greg Kroah-Hartman, maintainer of the Linux kernel stable tree, responded to Stenberg’s comparison: “I’m seeing the same for Linux as well. No idea what Aisle is doing differently, but wow…” That is a second, independent, and much larger codebase showing the same pattern — though it remains anecdotal until actual kernel CVEs with AISLE credit appear. Watch the stable-tree release notes over the coming weeks.

What This Means for Engineering Teams

The “AI security scanner” market is bifurcating, not maturing uniformly. Generic frontier-model prompting for security review and purpose-built discovery systems are diverging in results. If your team evaluates AI-driven security tooling, evaluate systems, not models — ask for the pipeline architecture, not just the underlying model name.
Slop is still the median outcome. curl shut its paid bug bounty in 2025 largely because of low-quality AI submissions (“death by a thousand slops,” in Stenberg’s words). Volume without external validation is negative value for maintainers. The lesson generalizes to any team about to point an AI agent at its own backlog.
Maintainer-side adoption is the quiet shift. curl is not using AISLE as an external auditor; it is running it internally for continuous assessment — the same goal the bounty served, without the spam. Kernel-adjacent projects watching Kroah-Hartman’s result may follow.
For your own threat model: these six CVEs are already fixed in 8.22.0. If your distribution or container images pin curl below 8.22.0, the practical action this week is the routine one — update. The wolfSSL and OpenSSL-provider items are worth prioritizing where those backends are in use.

Limitations

All six CVEs are Low severity; the headline should not be read as “AI found critical holes in curl.”
AISLE is the author of the comparison post, and the company has obvious commercial incentives. The mitigations are structural — the public timestamped baseline and curl’s independent review — but the framing is the vendor’s.
The Linux observation is a single public comment, not a dataset.
The number 29 counts reports filed, not vulnerabilities confirmed; 23 of 29 did not become CVEs.

The Takeaway

The result is less a scoreboard than a methodology template: public baselines, third-party adjudication, fixes shipped before claims published. On that template, specialized AI systems just out-performed two frontier labs’ security models on one of the world’s most audited codebases — and the maintainer of the Linux stable tree says the same thing is happening there. The era where “AI-found CVE” is automatically suspect is ending; the era where you must ask which AI, on which system, adjudicated by whom has begun.