GoKawiilAISLE's AI tool finds six curl CVEs days after OpenAI and Anthropic tools report none
After curl founder Daniel Stenberg ran OpenAI's Codex Security and Anthropic's Mythos against the widely-used curl codebase and got zero findings, AISLE's autonomous AI system produced 29 vulnerability reports. Six of those were validated by curl's security team and assigned CVE identifiers, all rated Low severity, and fixed in the newly released curl 8.22.0.
GoKawiil's interpretation of the reporting above, not reported fact.
Curl is one of the most audited open-source projects on Earth, running in over 20 billion instances, so any real vulnerabilities found in it are a meaningful benchmark for AI-driven security tools. The stark gap between AISLE's results and the zero findings from OpenAI's and Anthropic's tools raises questions about how different AI systems approach code auditing and whether some current models are missing subtle, real-world bugs in mature codebases.
- AISLE's AI system found 29 potential issues in curl versus zero from OpenAI and Anthropic tools
- Six of AISLE's findings were confirmed as genuine CVEs and patched in curl 8.22.0
- All six vulnerabilities were rated Low severity, reflecting curl's strong existing security posture
Hacking: The Art of Exploitation, 2nd Edition (No Starch Press) — If a story about six fresh curl CVEs makes you want to understand how memory bugs actually get found and exploited, Jon Erickson's classic is the hands-on place to start. It walks through C code, stack behavior, and exploitation techniques with real examples, which is exactly the territory these vulnerability hunts live in.
See Hacking: The Art of Exploitation, 2nd Edition (No Starch Press) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: aisle.com, 2026-09-02
Published there as: “Six curl CVEs after OpenAI and Anthropic came back with zero”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.