// ZDNET — INTELLIGENZA ARTIFICIALE
This AI tool found 6 Curl vulnerabilities Mythos and Codex missed – even Greg KH is impressed
Aisle found six Curl flaws after Mythos and Codex reported none.
You may not have heard of Aisle, an AI-native vulnerability-management startup, but some of the best open-source maintainers know it well and really like it. Why? Because Aisle finds real bugs that other, far better-known AI coding programs, such as Anthropic’s Mythos and OpenAI’s Codex, don’t.
Also: OpenAI’s agents exploited a patched Linux bug in Hugging Face incident: 6 steps to take ASAP
For example, Aisle recently said its security analysis system uncovered six previously unknown vulnerabilities in Curl that the open-source project’s maintainers accepted and assigned Common Vulnerabilities and Exposures (CVE) numbers. The findings arrived shortly after Curl founder Daniel Stenberg wrote on Mastodon that Mythos, OpenAI Codex Security, and ZeroPath had found no additional vulnerabilities in the widely deployed, open-source networking file-transfer project. Aisle, meanwhile, found 29.
Aisle achieves this success not because it uses expensive frontier models, but because, the company states, “even small models can recognize a vulnerability when handed the right snippet of code with leading context.” We “tested whether cheap models with enough throughput can surface real bugs without that hand-holding. The answer was yes: adequately intelligent models, deployed systematically across an entire codebase, can surface real bugs without hand-scoped snippets.”
Stenberg was fine with Aisle’s discoveries. Unlike in the past, when AI programs discovered bogus vulnerabilities and produced mountains of AI slop reports, they now find real security holes. As Stenberg put it, we’re now in the “high quality chaos era.” Still, as Stenberg commented on Mastodon, “I am grateful that all the most powerful AI engines all scan #curl to find flaws. Finding them means we can fix them. Sometimes it just demands coming up to the surface for a few deep breaths before we dive again.”
It’s not just Curl, though, that’s reaping the benefits of Aisle. As Greg Kroah-Hartman, the maintainer of the Linux stable kernel, put it, “I’m seeing the same for Linux as well. No idea what Aisle is doing differently, but wow…”
Jim Fuller, a Red Hat senior principal software engineer specializing in security, speculates that Aisle knows what it’s doing, knows the limitations of tooling, and I suspect has worked harder than just running a scanner.
Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried
In an interview, Stenberg added, “I think at least a part of this success (for both of us) is our communication and cooperation. We’ve met, we’ve talked, and they spend proper engineering time to make sure that we get curated results of top quality, which motivates us to take every Aisle report seriously.”