What's this about?
AISLE filed 29 reports. Six became CVEs. Three were reported on August 24, two on August 26, one on August 27, and by August 28 curl's pending CVE count had risen from three to ten — six of those ten from AISLE.
What happens to the other 23?
Some are duplicates, some are not vulnerabilities, some are real but not security-relevant, and some are wrong. That distribution is normal for any bug-hunting effort, human or automated, and the ratio here — roughly one in five accepted — is respectable. But it is also the number that matters for anyone deploying such a tool, because those 23 reports each cost a maintainer's attention. Volume is the thing that makes automated discovery a mixed blessing, and it is exactly what the curl CVE dispute a few days ago was about.
Why does this matter to you?
- A 6-in-29 acceptance rate is the honest headline, and the post does state it.
- It quantifies the triage burden: for every accepted finding, a maintainer read several that went nowhere.
- This is the operational argument for why Box's CEO says triaging the flood with more AI is the only way forward.