AISLE AI Discovers Six curl CVEs After OpenAI and Anthropic Find Zero

AISLE's autonomous AI system discovered six previously unknown vulnerabilities in curl that were subsequently assigned CVEs, occurring after frontier AI systems from OpenAI and Anthropic reported zero additional findings in the same codebase. This result supports the "System over Model" thesis, suggesting that specialized AI harnesses and autonomous systems can outperform raw frontier models in real-world zero-day discovery.

Six New CVEs Identified in curl 8.22.0

Following a public statement by curl founder Daniel Stenberg on August 24, 2026, noting that Anthropic Mythos and OpenAI Codex Security found no further vulnerabilities in curl, AISLE ran its autonomous system against the codebase. AISLE submitted 29 reports, six of which were validated by the curl security team and fixed in the curl 8.22.0 release.

All six vulnerabilities were rated as Low severity, reflecting the high engineering maturity of curl, where remaining flaws typically exist in narrow configurations or subtle interactions. The identified CVEs are:

• CVE-2026-80229: OpenSSL provider use-after-free
• CVE-2026-80230: OpenSSL pinning bypass
• CVE-2026-80231: native CA store connection reuse
• CVE-2026-80255: secure attribute bypass with tab
• CVE-2026-82208: wolfSSL CA-cache hit overrides callback
• CVE-2026-82209: domain-scoped public-suffix cookie

Validation and Methodology

This discovery process differed from standard AI cybersecurity benchmarks or Capture-The-Flag (CTF) challenges because it targeted current production code rather than known answers in training data. The validation was conducted by external domain experts—the curl maintainers—who decided if the findings were real and others if they warranted a CVE designation.

Because Daniel Stenberg's report of zero findings from OpenAI and Anthropic was timestamped and public before AISLE began its analysis, the comparison provides a verified baseline for zero-day discovery.

Broader Impact and Linux Kernel Observations

The pattern of AISLE outperforming frontier models appears to extend beyond curl. Greg Kroah-Hartman, the maintainer of Linux stable releases, reported seeing similar results in the Linux kernel, stating: "I'm seeing the same for Linux as well. No idea what Aisle is doing differently, but wow..."

Technical Community Perspectives

While the findings were validated by CVE assignments, the technical community has raised several points regarding the methodology and the nature of the results:

• System vs. Model: Critics argue that comparing a specialized AI harness (AISLE) to a base model (OpenAI/Anthropic) is an uneven comparison. One commenter noted, "Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities."
• Signal-to-Noise Ratio: Some observers pointed out that AISLE reported 29 issues but only 6 were CVEs, suggesting a higher false-positive rate. One user questioned if the frontier tools might have found the same issues but filtered them out due to lower severity.
• Real-world Utility: Other users reported positive experiences with the tool, with one noting that AISLE's scanner successfully chained two exploits together to find a bug in libnbd, providing a sensible patch for the fix.

"Since AISLE reported 29 issues but only 6 warranted a CVE, and all the found CVEs were "low" severity, this makes me wonder if AISLE simply is tuned for a higher false positive rate than the anthropic and openai tools."

"The tool basically had to chain two exploits together to reach this [libnbd bug]. It also came up with a patch to fix which was fairly sensible."