AISLE Outperforms Frontier AI in curl Vulnerability Discovery

By Stanislav Fort | Published September 2, 2026

The perceived dominance of "frontier" AI models can evaporate in an instant. While the industry often views the largest models as the gold standard, a recent real-world test proves that specialized systems can find what the giants miss.

The Setup: A Public Baseline

curl is one of the most scrutinized codebases on the planet, integrated into everything from simple smart refrigerators to complex spacecraft, with over 20 billion instances globally.

On August 24, 2026, Daniel Stenberg, the creator of curl, noted that only three CVEs were currently awaiting the next release. He then put frontier AI security tools to the test.

"[Anthropic] Mythos says it can’t find any more." — Daniel Stenberg

This public, timestamped declaration of "zero findings" by Anthropic Mythos and OpenAI Codex Security created a perfect baseline for a head-to-head comparison.

The Timeline of Discovery

The shift in results happened rapidly over the following few days:

The Results: Data Breakdown

While AISLE submitted 29 total reports, the curl security team validated six as serious enough to warrant official CVE designations. All six were patched in curl 8.22.0 and credited to Stanislav Fort of AISLE.

Note on Severity: The "Low" rating is a testament to curl's high engineering standards. Remaining bugs typically exist only in highly specific, narrow configurations, limiting their exploitability.

Why This Matters

This wasn't a simulated "Capture the Flag" (CTF) event or a benchmark using known data that might have leaked into a model's training set. This was an analysis of live production code.

The validation process was entirely external:

1. Independent Verification: The curl maintainers—not AISLE—decided what constituted a real bug.
2. Public Accountability: The baseline (0 findings) was published before AISLE ran its analysis.
3. Tangible Impact: The result was a set of fixed vulnerabilities for millions of users.

The "System over Model" Thesis

This event supports a broader architectural argument. Rather than relying on a single monolithic model, a specialized system can achieve superior results in zero-day discovery.

We can represent this conceptual shift as: $\text{Effectiveness} = \text{Specialized System} \gg \text{Frontier Model}$

This pattern isn't isolated to curl. Greg Kroah-Hartman, the maintainer of Linux stable releases, observed a similar trend: "I'm seeing the same for Linux as well."

Put AISLE to Work

The same engine used to uncover these flaws in curl and the Linux kernel is available for your own infrastructure via AISLE Snapshot.

Audit your code regardless of where it is hosted:

• Air-gapped environments
• On-premises servers
• Cloud deployments

# Example: Initiating an AISLE Snapshot audit
aisle-cli audit --target ./src/production_code --mode deep-scan