AISLE Finds Six curl CVEs After OpenAI and Anthropic Reported Zero
Six curl CVEs after OpenAI and Anthropic came back with zero
AISLE, an autonomous AI security system, discovered six previously unknown vulnerabilities in curl, a library used in over 20 billion instances worldwide, within days of OpenAI's Codex Security and Anthropic's Mythos reporting zero findings. The CVEs, all rated low severity, were fixed in curl 8.22.0. curl founder Daniel Stenberg publicly documented the zero results before AISLE's findings, providing a clean baseline. Linux stable maintainer Greg Kroah-Hartman noted similar results for Linux, suggesting a broader trend.
I'm seeing the same for Linux as well. No idea what Aisle is doing differently, but wow...
- melvinroest
Wow, this announcement is good content marketing.
Don't get me wrong, it's interesting. But there is no technical discussion as to how they did it. It's simply: we did it and Mythos and Codex didn't.
It's good to know that it's possible, but I'd have already expected it. Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities.
> We then ran AISLE's autonomous AI system against curl.
They don't even mention what models the use under the hood. It wouldn't surprise me if they are from Anthropic and OpenAI.
- rwmj
We had a few AISLE-generated security reports, and the signal to noise was reasonably good.
The most notable bug/exploit their scanner found was: https://gitlab.com/nbdkit/libnbd/-/commit/e50bbd2681117c2dd8...
The tool basically had to chain two exploits together to reach this. It also came up with a patch to fix which was fairly sensible (but I ended up editing it further for clarity).
- graemep
Curl seems to becoming one of the favourite things to demo AI finding vulns.
Curl is going to end up incredibly secure.
- markasoftware
Since AISLE reported 29 issues but only 6 warranted a CVE, and all the found CVEs were "low" severity, this makes me wonder if AISLE simply is tuned for a higher false positive rate than the anthropic and openai tools (which may have found the same 6 issues and decided not to report them)
- blmarket
I also have some secret recipe finding one class of bugs: https://github.com/tmux/tmux/issues?q=is%3Apr%20author%3Ablm...
curious they're willing to run AISLE on tmux to find more than mine.