A Startup’s AI Found Six curl Bugs Where Mythos Found None

On September 2, 2026 the curl project released version 8.22.0 with nine security advisories. Six of them credit the same reporter, Stanislav Fort of AISLE, a security startup whose autonomous analysis system was pointed at curl in the last week of August. All six are rated Low. That is the whole factual core of the story, and if it stopped there it would be a footnote on a disclosure ledger.

It does not stop there, because of what Daniel Stenberg, curl’s founder and lead developer, had posted nine days earlier. On August 24 he wrote that only three CVEs were pending for the next release and added, in parentheses: “Mythos says it can’t find any more. Zeropath finds no vulnerabilities. Codex security shows an empty list.” The day after AISLE ran, he posted a two-line scoreboard: “Mythos: 0. Aisle: 29.” A public, timestamped zero from the frontier labs’ systems, followed by a maintainer-validated six from a company most people had not heard of. For anyone deciding which AI to run against their own code, that is the useful comparison of the year so far, and it is worth reading carefully rather than loudly.

The sequence is the evidence, so here it is with each step’s source. On the morning of August 24 Stenberg posted on Mastodon that curl was nine days from its next release with three pending CVEs, “two low, one medium,” and that the AI systems the project uses had nothing further; a reply of his own the same morning added, “I’m under no illusion that the last vulnerability has been found. It just might be that the easy ones are picked now.” AISLE says it then ran its system against curl. curl’s own advisories record three of the eventual six reports arriving on August 24, two on August 26 and one on August 27. On August 25 Stenberg posted the scoreboard, “Mythos: 0. Aisle: 29,” and Greg Kroah-Hartman, who maintains the stable Linux kernel releases, replied that he was “seeing the same for Linux as well. No idea what Aisle is doing differently, but wow.”

AISLE’s blog says the pending count had risen from three to ten by August 28. What actually shipped on September 2, per curl’s own vulnerability table, was nine advisories: the three that were pending on August 24 and six from AISLE. We use curl’s number. The gap of one is the kind of detail that separates a vendor post from the record, and it is why this post is built on curl.se wherever the two overlap.

Every one of the six is rated Low by curl, which is the first thing to say about them and the thing AISLE’s own post says in its first screen. curl’s advisory for the use-after-free explains the profile: the bug needs a libcurl built against OpenSSL 3 providers, a pooled TLS connection that outlives its handle, and the multi interface, and it is marked as a “C mistake.” The others are of the same shape: narrow configurations, subtle interactions, real but not urgent. What is notable is their age. Per curl’s table, three of the six have been present since 7.x releases, one since 7.45.0, in a codebase Stenberg describes as fuzzed, audited and scanned by every AI tool the project can get.

Most claims about AI bug-finding come from benchmarks: capture-the- flag sets and vulnerability suites with known answers, some of which are old enough to be in training data. AISLE’s post makes the point itself, and it is right: this was current production code, and “curl’s maintainers, not us, decided both whether each finding was real and whether it warranted a CVE.” The baseline was posted by the maintainer before the challenger ran, which removes the usual suspicion that the comparison was staged after the fact. Twenty-three of the 29 reports did not become CVEs, and neither AISLE nor curl has said how many of those were bugs, duplicates or noise, so the precision of the run is not public. The six that survived are.

Three caveats belong in the same paragraph as the result. First, “Mythos: 0” is Stenberg’s summary of a scan run on his behalf; neither the prompt nor the harness is published, and AISLE’s post is an interested party’s account. Second, all six findings are Low, so “six to zero” is a count, not a severity-weighted score. Third, this is one codebase, which is exactly the caveat Stenberg applied to Mythos in May and which applies equally here. Our ledger of AI-assisted disclosures gains a row from this; the row says six Low CVEs, curl 8.22.0, and nothing grander.

The September result reads differently with the May post beside it. In April, as Stenberg put it, Anthropic had concluded Mythos was “dangerously good” at finding security flaws and restricted it to Project Glasswing partners. Stenberg was offered access through the Linux Foundation, the access was delayed, and a first Mythos scan of curl’s master branch, 178,000 lines, was run for him and delivered on May 6. The report claimed five “confirmed security vulnerabilities.” After the curl security team reviewed them, one remained, headed for a Low CVE; the other four were three false positives and one “just a bug.” The report also surfaced about twenty ordinary bugs, which Stenberg described as nicely explained with barely any false positives.

His conclusion on May 11 was careful in a way the coverage of it was not: “the big hype around this model so far was primarily marketing,” with “no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos,” and in the same post, that AI analyzers as a class are “significantly better at finding security flaws and mistakes in source code than any traditional code analyzers,” and that a project not using them leaves attackers time and opportunity to find the flaws it misses. Between May and August, on his account, AI tools had already triggered two to three hundred merged fixes in curl. The September scoreboard is that same argument with numbers attached: the tool matters enormously, and the biggest model is not automatically the best tool.

The market for AI vulnerability discovery now has three shapes: gated frontier models such as Mythos and Google’s new 3.8 Flash Cyber, available only to vetted defenders; vendor scanners built on a lab’s own model, such as Codex Security, described in our note on OpenAI’s patch-the-planet push; and specialised systems such as AISLE, Zeropath and their peers that orchestrate whatever models they can get. The curl result does not rank the three. It shows that access to the largest model is not the deciding variable, and that maintainer validation is the only score that counts. The router below is how we would read it.

For a company that ships software rather than researches it, the practical version is shorter. Put an AI analyzer on the codebase if there is not one already; Stenberg’s May post is the clearest maintainer statement on record that projects without one are leaving flaws for attackers. Then judge the tool by what your own reviewers accept, the same way curl did. That review discipline is part of how our web development practice runs AI review on client code: the model proposes, a person with context decides, and the count that gets reported is the accepted one.