AI Found 6 curl CVEs That Frontier Models Missed

On 24 August 2026, curl's founder Daniel Stenberg posted that with nine days to the next release, curl had only three pending CVEs to announce — two low, one medium — and that the frontier AI security scanners pointed at the project had come up empty. Anthropic's Mythos: nothing. OpenAI's Codex security: an empty list. ZeroPath: nothing. The following day he posted the update that a lot of people screenshotted: "Mythos: 0. Aisle: 29." A little-known startup's system had filed 29 findings against a codebase that three frontier models had just declared clean, and six of them were accepted as real CVEs and patched in curl 8.22.0 on 2 September 2026.

That result matters less because of the six bugs — they are all rated low severity — and more because of what it says about how AI is going to find vulnerabilities from here on. curl is not soft target. It ships in an estimated 30 billion devices: operating systems, containers, CI/CD runners, package managers, SDKs, cars. It is one of the most-read, most-fuzzed, most-audited C codebases on the internet. Three of the best general-purpose models on the market scanned it and found nothing new. A purpose-built pipeline running cheaper models found six. The gap is not model horsepower. It is system design.

What AISLE's AI vulnerability discovery actually found

The six accepted CVEs, all fixed in curl 8.22.0 and reported by Stanislav Fort of Aisle Research, cluster tightly around one part of the library — TLS session and connection handling:

CVE	Component	Class
CVE-2026-80229	OpenSSL 3 provider, multi interface	Heap use-after-free (pooled TLS connection outlives its easy handle)
CVE-2026-80230	OpenSSL certificate pinning	Pinning bypass
CVE-2026-80231	Native CA store	Wrong connection reuse
CVE-2026-80255	Cookie handling	Secure-attribute bypass via tab character
CVE-2026-82208	wolfSSL CA cache	Cache hit overrides the verification callback
CVE-2026-82209	Cookie handling	Domain-scoped public-suffix cookie

None of these is a remote-code-execution headline. CVE-2026-80229, the most interesting of the set, is a use-after-free where a TLS connection pooled by libcurl's multi interface can outlive the easy handle that created it, leaving a dangling pointer into freed OpenSSL provider state — reachable only under specific OpenSSL 3 configurations, which is why it scores low. The point was never the severity. The point is that Aisle filed 29 candidates, six survived triage into CVEs, and the same window produced zero from three frontier models. Greg Kroah-Hartman, the Linux stable-kernel maintainer, replied to the thread: "I'm seeing the same for Linux as well. No idea what Aisle is doing differently, but wow."

Why frontier models found zero

The lazy read is "bigger model, more bugs." The curl result is the counterexample. Aisle's stated thesis is that a specialized system built on cheaper models beats a frontier model run as a scanner, and it runs locally without shipping the target code out to an API. Stenberg, who has spent two years pushing back on the flood of AI-generated slop reports on curl's HackerOne queue, was blunt about why he took these seriously: Aisle "spend proper engineering time to make sure that we get curated results of top quality." Twenty-three of the 29 reports did not become CVEs — that is not a failure, it is triage working, which is precisely what a raw model dumping findings into an issue tracker does not do.

The difference is the scaffolding around the model, not the model. A frontier scanner run one-shot over a file answers "is there a bug in this function." A discovery pipeline maintains state across the whole codebase, forms a hypothesis about a bug class, and then goes looking for every place that class recurs. That is a fundamentally different search, and it is why the second read of the curl findings is the one that should worry defenders.

AI vulnerability discovery finds patterns, not one-off bugs

Look at what Aisle found and then look at curl's own history. The June 2026 release fixed CVE-2026-8932, a connection-reuse authentication bypass that had shipped since curl 7.7 on 22 March 2001 — the oldest security issue ever reported in the project, undetected for 25 years. It is not a novel class. curl has been patching connection-reuse and TLS-session use-after-free bugs for a decade:

• CVE-2016-5421 — use-after-free letting an attacker influence which connection is used.
• CVE-2020-8231 — dangling pointer causing libcurl to use the wrong connection.
• CVE-2021-22901 — use-after-free when a TLS 1.3 session ticket arrives over a connection.
• CVE-2023-27536 — authentication bypass in the connection-reuse feature.

The 2026 findings — 80229, 80231, the 25-year-old 8932 — are the same family. That is the tell. An agentic pipeline that has internalized "libcurl reuses connections and TLS sessions across handles, and the lifetime bookkeeping is fragile" will grind through every reuse path in the code looking for the next dangling pointer. A fuzzer needs a reproducing input; a one-shot LLM scan needs the bug to be visible in the window it was shown. Pattern-directed search over the whole tree sits between them, and it is exactly the capability that just out-performed three frontier models on curl.

"So the AI didn't invent a new attack — it just found six more of a bug we've been shipping for twenty-five years?" "Yes. That is the harder problem, and it's the one that scales."

What this means for defenders

Two conclusions follow, and neither is comfortable.

First, "heavily audited" is not a finish line. curl is fuzzed continuously by OSS-Fuzz, read by thousands of engineers, and maintained by someone who treats security reports as a full-time job. It still yielded six findings to a system that did not exist eighteen months ago. Any internal codebase that has had less scrutiny — which is all of them — is carrying more.

Second, this capability is model-agnostic and cheap. Aisle's whole argument is that you do not need frontier access to run it; you need the right system around a modest model, and it runs on-prem. That is good news for defenders who want to run it themselves and bad news because it means the same pattern-directed discovery is available to whoever is pointing it at your code, on their hardware, without an API bill or a rate limit. The asymmetry that used to protect obscure internal software — "nobody will bother reverse-engineering this" — is being priced out.

Remediation

The six curl CVEs are low severity and already patched, so the action here is less "emergency" and more "prove you can actually do it," because curl is the hardest possible inventory problem: it is embedded, not installed.

1. Am I affected? — the versions fixed in 8.22.0 are curl 8.14.0 through 8.21.0. The visible curl binary is the easy part:

curl --version | head -1
# find every libcurl on disk, not just the one on $PATH
find / -name 'libcurl*.so*' 2>/dev/null -exec sh -c 'echo "$1:"; strings "$1" | grep -m1 "^libcurl/"' _ {} \;

The hard part is the copies you did not install: statically linked into vendor binaries, baked into container base images, shipped inside language runtimes and SDKs, burned into appliance and IoT firmware. Pull it from your SBOMs and container image scans, not just the host package manager — grep your image inventory for curl and libcurl and reconcile against 8.22.0.

2. Patch — exact fixed version. Upgrade curl and libcurl to 8.22.0 or later. For containers, rebuild from a refreshed base image; a curl upgrade on the host does not touch the libcurl statically linked into a running image.

3. Can't patch now? — compensating controls. These bugs live in TLS connection and session reuse. Where an application uses libcurl's multi interface against untrusted TLS endpoints, disabling connection reuse (CURLOPT_FRESH_CONNECT / CURLOPT_FORBID_REUSE) closes the use-after-free and reuse-confusion paths at a performance cost. Pin certificates at the application layer rather than relying on the affected pinning path.

4. Hunt for compromise. There are no clean network IOCs for a low-severity local UAF — the honest detection posture is to treat these as reliability-affecting for now and watch for the consequences of a wrong-connection bug: TLS sessions to an endpoint the process should not be talking to, credentials or cookies appearing on connections they were not scoped to. Map the abuse to MITRE ATT&CK T1557 (Adversary-in-the-Middle) for the reuse/pinning bypasses and T1552 (Unsecured Credentials) for the cookie-scope and netrc-adjacent classes.

5. Eradicate + verify. After patching, confirm the running process actually loaded the new library — lsof -p <pid> | grep libcurl on a live process, not just the on-disk version — because a long-running service keeps the old libcurl mapped until restarted. Rebuild and redeploy containers; do not trust an in-place host patch to have reached them.

Where Zero Hunt fits

The curl result is, quietly, a validation of a bet Zero Hunt made in its architecture. The industry reflex is to point the biggest available frontier model at a target and ask it to find bugs. Aisle's six CVEs against three empty frontier scanners say that is the wrong shape: what wins is a purpose-built system that holds state across the whole target, reasons about bug classes, and triages its own output — run on models you control, locally.

That is what Zero Hunt's 10-agent swarm is. It is not a single model prompted to "find vulnerabilities." Recon, Exploit, Web, Credential, Post-Exploit, Pivot, Tactic and Report agents are coordinated by an AI Controller, and every exploit is written per-target by a local LLM on the appliance — no code leaves the box, no external API sees your source or your traffic, exactly the on-prem model Aisle argues for. The pattern-directed search that let Aisle find the sixth connection-reuse bug after finding the first is the same discipline behind the AI Gym: 142+ self-evolving skills, backtested against Vulhub, NYU CTF Bench and 314 CVE-based black-box tasks before any skill touches a real target, so a new capability is proven to generalize rather than trusted to. And because every finding is ECDSA-signed at write time, the output is an audit trail, not a raw dump of 29 candidates for someone else to triage.

curl got six low-severity bugs and a patch. The durable lesson is the one Greg Kroah-Hartman flagged from the kernel side: purpose-built agentic discovery is already finding, in the most-audited code on the internet, bugs that have been sitting there for twenty-five years. The only question a defender should ask is whether that capability reaches their own code first from their red team, or first from someone else's.