What's this about?
On August 24, curl's founder Daniel Stenberg posted that only three CVEs were pending for the next release, and added that after running frontier AI security systems over the codebase: "[Anthropic] Mythos says it can't find any more. ... [OpenAI] Codex security shows an empty list." A startup called AISLE then ran its own system over the same code. The next day Stenberg posted the comparison himself: "Mythos: 0. Aisle: 29." Of those 29 reports, curl's security team accepted six as public CVEs, all fixed in curl 8.22.0, all crediting AISLE's Stanislav Fort as reporter. By August 28 curl's pending CVE count had gone from three to ten.
Why is curl a meaningful target?
It is deployed across more than 20 billion instances, from smart fridges to spacecraft, and it is one of the most heavily audited codebases in existence — decades of scrutiny, an active security process, and a maintainer who publishes every finding. It is close to a worst case for a bug-finding tool: everything easy was found long ago. That is exactly what makes a result here mean something, and also why all six findings are Low severity.
What's the community saying?
- The first reaction is fair: "that's bragging rights correctly earned" — while noting the post is unambiguously content marketing.
- The substantive complaint: there is no technical discussion of *how*. It is "we did it and they didn't", which is interesting but not informative.
- Commenters went and found out anyway — see the next entry, which is the actual story.
- A prescient guess from the thread before anyone had checked: maybe the model does not matter, and you just need something minimally intelligent to seed a fuzzer, generate a test case, and repeat when it gets stuck.