Following reports from Anthropic’s Mythos and OpenAI’s Codex Security indicating zero vulnerabilities in the curl codebase, AISLE’s autonomous AI system identified 29 potential issues, leading to the discovery of six previously unknown zero-day vulnerabilities. While frontier AI models failed to detect flaws in the widely deployed software, AISLE’s analysis resulted in six distinct CVEs officially designated for curl version 8.22.0. These vulnerabilities, all rated as Low severity, were reported between August 24 and August 27, 2026, and were validated by curl’s security team. The discovery process was unique because it involved analyzing live production code rather than static benchmark datasets, providing an external validation of AISLE's efficacy against established AI models. The impact of these findings was significant, contributing to an increase in curl's pending CVE count from three to ten. Furthermore, the methodology appeared to scale beyond curl, as Linux maintainer Greg Kroah-Hartman reported observing similar patterns of discovery when using the AISLE engine on the Linux kernel. All six identified vulnerabilities were addressed in the 8.22.0 release, with Stanislav Fort credited for the reports. This outcome highlights a divergence in performance between AISLE's autonomous auditing system and existing frontier AI cybersecurity tools when evaluating highly mature, audited codebases.
Read original
hackernews