AISLE AI Discovers Six Low-Severity CVEs in curl After OpenAI and Anthropic Found Zero

Vulnerability Discovery in curl

AISLE's autonomous AI system identified six new Common Vulnerabilities and Exposures (CVEs) in curl. These findings were reported to the curl security team, which confirmed their validity and assigned CVE designations. The vulnerabilities were subsequently addressed and fixed in the curl 8.22.0 release.

Comparison with Other AI Systems

The discovery by AISLE followed reports from OpenAI Codex Security and Anthropic Mythos, which had both indicated zero findings in curl. curl founder Daniel Stenberg had publicly noted these zero results before AISLE's analysis. This sequence of events provided a direct comparison of the AI systems' effectiveness in identifying previously unknown flaws in a widely deployed and heavily audited codebase.

Details of the CVEs

The six CVEs discovered are: CVE-2026-80229 (OpenSSL provider use-after-free), CVE-2026-80230 (OpenSSL pinning bypass), CVE-2026-80231 (native CA store connection reuse), CVE-2026-80255 (secure attribute bypass with tab), CVE-2026-82208 (wolfSSL CA-cache hit overrides callback), and CVE-2026-82209 (domain-scoped public-suffix cookie). All six are rated as low severity, consistent with curl's engineering maturity where remaining vulnerabilities are often subtle and have limited practical impact. Stanislav Fort from AISLE is credited as the reporter for all six.

Implications for AI in Cybersecurity

This event serves as an example of AI systems identifying zero-day vulnerabilities in production code, rather than in controlled benchmark environments. The validation process involved curl's maintainers independently assessing the findings and determining their CVE status, providing external validation for the AI's discovery capabilities.