AISLE reports six curl CVEs after Codex and Mythos return zero findings

Daniel Stenberg posted on August 24 2026 that both frontier systems returned empty lists against curl. AISLE then generated 29 reports; curl maintainers accepted six as valid CVEs within days and merged fixes before the 8.22.0 release. The CVEs cover narrow cases such as native CA store reuse, secure attribute bypass, and wolfSSL cache overrides, each credited to Stanislav Fort.

Stenberg's timestamped zero-result post established a public baseline. Pending CVE count rose from three to ten, with six originating from AISLE. Greg Kroah-Hartman noted identical patterns in Linux stable reviews. All six CVEs received low severity ratings, consistent with curl's maturity where remaining flaws require specific configurations.

Frontier LLMs exhibit systematic blind spots on subtle state interactions in heavily audited code, a pattern analogous to adversarial examples that evade detection despite extensive training. This outcome questions deployment safety for security-critical tasks without specialized robustness measures. AISLE Snapshot now offers the same engine for external codebases.

Linux kernel maintainers have begun similar scans, indicating potential for rapid expansion of verified zero-day discovery across core infrastructure projects.