Twenty-nine reports, six CVEs in curl: a start-up finds what Codex and Mythos hadn't seen

The curl maintainer had announced that the OpenAI and Anthropic tools were no longer reporting anything; the next day, AISLE delivered twenty-nine reports.

On August 24, Daniel Stenberg, curl founder, reported that only three CVEs were waiting for the next release, stating that Anthropic's Mythos tool was missing and that OpenAI's Codex Security list was empty. The next day, the AISLE start-up pointed to its stand-alone analysis system on the same code basis and filed 29 alerts.

Six resulted in VECs, attributed to Stanislav Fort, corrected and delivered in curl 8.22.0 on September 2. All are classified in low severity, and relate to specific areas of TLS management and cookies: use after release on the OpenSSL side, circumvention of certificate pinning, re-use of connection via the native authority store, circumvention of the secure attribute by means of a tab, crushing callback on the authority cache with wolfSSL, and a domain-accessible cookie on a public suffix. The gap counter has increased from three to ten in four days.

AISLE draws an argument that it formulates as "the system rather than the model": the performance of a security product would depend less on the raw power of the foundation model than on the apparatus around it — orchestration of agents, context provided on the basis of code, formulation of vulnerability assumptions, validation loops and reproduction of cases. Greg Kroah-Hartman, maintainer of stable Linux kernels, said he observed the same gap. Since curl is deployed on more than twenty billion instances, the demonstration focuses less on the severity of the six faults than on what it says about the tools that are supposed to find them.