// HACKER NEWS — CYBERSECURITY
Six curl CVEs after OpenAI and Anthropic came back with zero
AISLE discovered six curl CVEs within days of OpenAI Codex Security and Anthropic Mythos reporting zero findings in curl, software deployed across more than 20 billion instances worldwide.
On August 24, 2026, curl founder Daniel Stenberg wrote that only three CVEs were pending for the next release. After using frontier AI cybersecurity systems to analyze curl, he added:
"[Anthropic] Mythos says it can’t find any more. ... [OpenAI] Codex security shows an empty list."
Daniel Stenberg’s August 24 post: the public, timestamped zero-result that preceded AISLE’s findings.
Daniel had recently documented Mythos's results on curl, one of the world's most heavily audited codebases which is deployed everywhere from smart fridges to spacecraft. We then ran AISLE's autonomous AI system against curl.
The next day, before the review process was complete, Daniel posted: "Mythos: 0Aisle: 29".
The next day, Daniel posted the first public comparison: Mythos 0, AISLE 29 reports.
Of the 29 AISLE reports, 6 were reviewed within days by curl’s security team, which deemed them serious enough to merit a public CVE designation for curl 8.22.0, which has just been released. They are:
All six are rated Low severity. This profile is consistent with curl's exceptional engineering maturity: the vulnerabilities that remain tend to hide in narrow configurations and subtle interactions, limiting their practical impact. All six were fixed in curl 8.22.0 and officially credit Stanislav Fort (from AISLE) as the reporter. Three were reported on August 24, two on August 26, and one on August 27, 2026.
Unlike typical evaluations of AI for cybersecurity, this was not a capture-the-flag challenge or a benchmark with known answers that might already appear in model training data. AISLE analyzed current production code, and curl’s maintainers, not us, decided both whether each finding was real and whether it warranted a CVE.