GoKawiilAISLE discovered six curl CVEs within days of OpenAI Codex Security and Anthropic Mythos reporting zero findings in curl, software deployed across more than 20 billion instances worldwide.
On August 24, 2026, curl founder Daniel Stenberg wrote that only three CVEs were pending for the next release. After using frontier AI cybersecurity systems to analyze curl, he added:
"[Anthropic] Mythos says it can’t find any more. ... [OpenAI] Codex security shows an empty list."
Daniel Stenberg’s August 24 post: the public, timestamped zero-result that preceded AISLE’s findings.
Daniel had recently documented Mythos's results on curl , one of the world's most heavily audited codebases which is deployed everywhere from smart fridges to spacecraft. We then ran AISLE's autonomous AI system against curl.
The next day, before the review process was complete, Daniel posted : "Mythos: 0
Aisle: 29".
The next day, Daniel posted the first public comparison: Mythos 0, AISLE 29 reports.
Of the 29 AISLE reports, 6 were reviewed within days by curl’s security team, which deemed them serious enough to merit a public CVE designation for curl 8.22.0 , which has just been released. They are:
CVE-2026-80229 : OpenSSL provider use-after-free CVE-2026-80230 : OpenSSL pinning bypass CVE-2026-80231 : native CA store connection reuse CVE-2026-80255 : secure attribute bypass with tab CVE-2026-82208 : wolfSSL CA-cache hit overrides callback CVE-2026-82209 : domain-scoped public-suffix cookie
... continue reading