curl 8.22.0 shipped on 2 September with ten security advisories, the project’s largest CVE release. Six of them came from an autonomous system built by a startup called AISLE, which submitted 29 reports to get them.
Two frontier models had already looked at the same code and found nothing.
What AISLE reported
The six accepted findings are CVE-2026-80229, 80230, 80231, 80255, 82208 and 82209 — an OpenSSL provider use-after-free, an OpenSSL pinning bypass, a native CA store connection reuse issue, a secure-cookie attribute bypass using a tab character, a wolfSSL CA-cache callback override, and a domain-scoped public-suffix cookie.
All six are rated Low. All six appear in curl maintainer Daniel Stenberg’s own release announcement, which is the check that matters: the CVE identifiers AISLE claims are the identifiers curl actually published.
The comparison AISLE is selling
AISLE’s headline is that OpenAI’s Codex Security and Anthropic’s Mythos returned zero on the same production codebase before it ran.
That claim has independent support, which is unusual for vendor marketing. Stenberg posted on Mastodon on 24 August that “Mythos says it can’t find any more” and that “Codex security shows an empty list”, and followed it a day later with a scoreline: “Mythos: 0 Aisle: 29”.
AISLE does not say when the OpenAI and Anthropic systems were run, or under what configuration. A zero from a tool someone else pointed at a codebase is weaker evidence than a zero from a controlled comparison, and this was not one.
The ratio is the story
Twenty-nine reports produced six CVEs. Twenty-three did not survive review — a 21% acceptance rate, with every accepted finding rated Low.
That is not a failure. It is what automated vulnerability discovery currently looks like from the maintainer’s side: a volume of plausible reports that a human has to read, most of which go nowhere, and a residue of real but minor issues. The cost of the twenty-three is borne by the project, not by the tool.
What curl’s release notes say about AI
Nothing. Stenberg’s announcement lists ten CVEs, 302 bugfixes and 85 contributors, and does not mention AISLE, AI-assisted reporting, or the comparison anywhere.
The narrative around this release belongs entirely to the vendor. The advisories belong to curl.
What to watch
Whether the acceptance rate improves. Six Low findings for 29 reports is a workable trade for a project the size of curl, which ships in an estimated tens of billions of devices. It is a much worse trade for a maintainer with no security team and no time to triage.
