Aisle reports six low-severity curl CVEs after Codex Security and Mythos returned zero
- curl's security team accepted six AISLE reports as public CVEs and fixed all six in curl 8.22.0; every CVE is rated Low severity.
- In an August 24 Mastodon post, curl founder Daniel Stenberg said Anthropic Mythos found no further issues and OpenAI Codex Security had an empty list; AISLE then submitted 29 reports, six of which received CVEs.
- The six CVEs cover an OpenSSL provider use-after-free, an OpenSSL pinning bypass, native CA-store connection reuse, a secure-cookie attribute bypass, a wolfSSL CA-cache callback issue, and a domain-scoped public-suffix cookie issue.
- Three AISLE reports were submitted on August 24, two on August 26, and one on August 27; by August 28, curl's pending CVE count had risen from three to ten, with six attributed to AISLE.
- Linux stable maintainer Greg Kroah-Hartman replied to Stenberg that he was seeing a similar pattern in Linux, while the article gives no technical details on AISLE's models or analysis workflow. The post also promotes AISLE's code-audit service.
Hacker News opinions
AISLE earned some bragging rights here. The post is marketing-heavy, but six accepted CVEs after the others reported zero is worth watching.
I find it interesting, but the announcement gives no technical account of how AISLE did this or which models it runs. A base model plus a good harness, tooling, and workflow should beat a base model alone.
I would assume AISLE uses its own models, wouldn't it?
The homepage describes AI-guided fuzzing around libFuzzer or AFL. My guess is that LLMs select functions, generate harnesses, and help triage fuzzer results, which is a sensible setup.
AISLE says its system can run with different models, and its earlier post has more detail. I would not assume this is a clean comparison of one proprietary model against another.
The public code appears to default to gpt5.4 nano for its analyzer. That makes the model comparison even less clear than the marketing implies.
I have seen several AISLE-generated reports, and the signal-to-noise ratio was reasonably good. It found a libnbd exploit that needed two issues chained together, then proposed a patch that I only had to edit for clarity.
To me, this is evidence that local or air-gapped models with the right context and tools can match or beat cloud systems on this task. I expect this capability to become commonplace over time.
OpenAI and Anthropic had already studied curl for a while, so earlier findings may have been fixed before this run. A fair comparison would use an older curl release that none of the tools had examined, though the six CVEs are all low severity.
I think the timeline does compare the same current codebase: Mythos and Codex reported zero, then AISLE reported about 29 issues, and six cleared curl's CVE bar. The release also included four CVEs found by others before that scan.
AISLE submitted 29 reports but only six became low-severity CVEs. It may simply accept a higher false-positive rate, while the other systems could have found the same issues and withheld them.
Mythos has previously produced a low-severity curl CVE, plus three false positives and one non-security bug. So it does report low-severity issues and is noisy too.
Upstream handling may be the real bottleneck. Other systems may focus on critical reports because maintaining developer interactions at high volume is hard.
I cannot compare a specialized harness to a model alone. Those are different systems, and the article does not explain enough to separate the harness, models, and reporting policy.
Calling this 'discovering CVEs' is loose language. AISLE found edge-case bugs that curl maintainers judged to be vulnerabilities and then assigned CVEs, all with low severity.