Six curl CVEs land after two AI scanners found none

AISLE's autonomous analysis system produced 29 vulnerability reports against curl, and curl's security team accepted six of them as CVEs in the 8.22.0 release. The findings came days after curl founder Daniel Stenberg publicly posted that two frontier AI security systems had found nothing left in the codebase, according to AISLE.

At a glance

• Stenberg's August 24, 2026 post said Anthropic's Mythos "can't find any more" and that OpenAI's Codex security showed "an empty list", with three CVEs then pending for the next curl release.
• The six accepted issues are all rated Low severity, were reported on August 24, 26 and 27, and credit AISLE's Stanislav Fort; by August 28 curl's pending CVE count stood at ten.
• The run targeted current production code rather than a capture-the-flag challenge or benchmark, and curl's maintainers decided both whether each report was real and whether it warranted a CVE.

Zero-result baselines published by an independent maintainer, before the challenger runs, are rare enough that this comparison likely carries more weight than benchmark scores or capture-the-flag exercises. The severity ratings matter less here than the arbitration: acceptance came from curl's security team, not from the vendor announcing the win. The outcome also reads as evidence that coverage depends on the system assembled around a model rather than on model capability alone.

Six of the 29 AISLE reports became CVEs in curl 8.22.0

The six are CVE-2026-80229, an OpenSSL provider use-after-free; CVE-2026-80230, an OpenSSL pinning bypass; CVE-2026-80231, native CA store connection reuse; and CVE-2026-80255, a secure attribute bypass with a tab. The remaining two are CVE-2026-82208, a wolfSSL CA-cache hit that overrides the callback, and CVE-2026-82209, a domain-scoped public-suffix cookie.

All six are rated Low severity and were fixed in curl 8.22.0, which officially credits Stanislav Fort of AISLE as the reporter. AISLE attributes that severity profile to curl's engineering maturity, saying the flaws that remain tend to hide in narrow configurations and subtle interactions, which limits their practical impact.

Three of the reports were filed on August 24, two on August 26, and one on August 27, 2026. The curl security team reviewed the six within days and deemed them serious enough to merit public CVE designations for version 8.22.0, which has just been released.

Curl's pending CVE count went from three to ten by August 28

On August 24, 2026, Stenberg wrote that only three CVEs were pending for the next curl release, after using frontier AI cybersecurity systems to analyze the code. The following day, before the review process was complete, he posted the first public comparison: Mythos 0, AISLE 29.

[Anthropic] Mythos says it can’t find any more. ... [OpenAI] Codex security shows an empty list.

By August 28 the pending CVE count for curl had risen from three to ten, with six of the ten originating in AISLE's reports, filed after the publicly reported zero result from the frontier systems built by Anthropic and OpenAI.

The curl codebase is among the most heavily audited in circulation, deployed across more than 20 billion instances worldwide, from smart fridges to spacecraft. AISLE ran its autonomous system against it after Stenberg had publicly documented Mythos's results on the same code.

AISLE says curl's maintainers decided which findings counted

AISLE says this was not a capture-the-flag exercise or a benchmark with known answers that could already appear in model training data. The system analyzed current production code, and curl's maintainers, not AISLE, decided both whether each finding was real and whether it warranted a CVE designation.

AISLE describes CVEs as imperfect markers that still provide strong external validation for zero-day discovery, since each is a previously unknown flaw in production code that domain experts reproduced, accepted and fixed. The curl result, in AISLE's framing, is another entry in a series supporting its System over Model thesis, that specialized systems can outperform frontier lab systems at real-world zero-day discovery.

Kroah-Hartman's kernel observation

AISLE says the pattern may not be limited to curl: Greg Kroah-Hartman reported the same effect on the Linux kernel, writing that he has no idea what AISLE is doing differently. The same discovery engine is being offered as a one-time audit, AISLE Snapshot, run against code held air-gapped, on-premise or in the cloud.