Aisle, an AI-native vulnerability-management startup, uncovered six previously unknown security flaws in Curl that project maintainers accepted and assigned CVE numbers, according to a September 2026 report from ZDNET. The discoveries came shortly after Curl founder Daniel Stenberg noted that well-known AI coding programs including Anthropic's Mythos, OpenAI's Codex Security, and ZeroPath had identified no additional vulnerabilities in the widely deployed open-source networking file-transfer project. Aisle, meanwhile, reported 29 candidate issues, of which six cleared Curl's security review bar as confirmed CVEs.

All six Aisle-reported vulnerabilities were patched in Curl version 8.22.0, released September 2. Curl's own advisory database classifies the six CVEs as low severity, while the project's release notes list them among the 10 security vulnerabilities addressed in the release. Greg Kroah-Hartman, maintainer of the Linux stable kernel, observed he's seeing the same results for Linux, commenting that he has no idea what Aisle is doing differently. Jim Fuller, a Red Hat senior principal software engineer specializing in security, speculates that Aisle knows what it's doing, understands the limitations of tooling, and has worked harder than just running a scanner.

Stenberg said in an interview that at least part of this success stems from communication and cooperation, noting that Aisle spends proper engineering time to deliver curated results of top quality, which motivates Curl maintainers to take every Aisle report seriously. The company states that even small models can recognize a vulnerability when handed the right snippet of code with leading context. Aisle tested whether cheap models with enough throughput can surface real bugs without hand-scoped snippets, finding that adequately intelligent models deployed systematically across an entire codebase can surface real bugs without that hand-holding.

The report explains that Aisle's success illustrates a "system over model" argument: that an AI security product's results depend less on the raw capability of its underlying foundation model than on the surrounding system, including agent orchestration, codebase context, vulnerability hypotheses, validation loops, and workflows for reproducing and remediating candidate issues. A general-purpose model can be highly capable at reasoning about code yet produce uneven results when asked to inspect a large, mature project through a one-off scan, according to the analysis. A specialized system can potentially gain an advantage by iterating over code paths, tracking configuration-specific behavior, correlating libraries and historical vulnerability patterns, ranking leads, and testing them before presenting a report.

The report concludes that Aisle's performance on Curl offers a meaningful early result for specialized, agentic security systems on one of open source's most hardened C codebases. Whether the outcome proves repeatable across other projects, languages, and operational environments remains the next question. The analysis notes that when Stenberg, Kroah-Hartman, and Fuller, all of whom know finding and fixing security bugs like the back of their hands, are impressed, the startup demands attention from anyone serious about finding and fixing vulnerabilities. The methodology lesson may prove more important than raw capability comparisons: here, Curl's maintainers controlled the decisive outcome by reviewing reports, deciding whether they represented security vulnerabilities, issuing CVEs, creating patches, and incorporating fixes into a public release, demonstrating why "findings" and "confirmed vulnerabilities" should not be treated as interchangeable. Organizations evaluating AI security tools may discover that vendor reputation matters less than the discipline of the system itself. The real test isn't whether a tool can flag thousands of possible issues, but whether it respects the maintainer's time enough to send only the ones that count.