After nearly a year of credible vulnerability discoveries, cURL founder Daniel Stenberg asked AISLE to conduct a comprehensive security review; the company’s AI-native platform has surpassed 500 validated CVEs across more than 100 codebases
SAN FRANCISCO and PRAGUE, Oct. 14, 2026 (GLOBE NEWSWIRE) — AISLE, a pioneer in AI-native vulnerability lifecycle management, today announced that vulnerabilities discovered by its AI-powered security platform accounted for 18 of the 24 CVEs addressed in cURL’s October 14 release, representing 75% of the total. The findings follow nearly a year of collaboration during which AISLE consistently identified legitimate security vulnerabilities, prompting cURL founder Daniel Stenberg to request a comprehensive security review. Stenberg credits the collaboration with helping cURL identify and fix more vulnerabilities faster than ever before.
AISLE has identified a cumulative total of 35 CVEs and 160 additional security and performance bugs in cURL, one of the world’s most widely deployed software components. Among those discoveries was an authentication vulnerability dating back 25 years, demonstrating the potential of specialized AI to uncover security weaknesses in even the most mature and extensively scrutinized codebases.
The latest cURL discoveries also coincide with a significant milestone for AISLE: more than 500 assigned CVEs across over 100 codebases in its first year since emerging from stealth. Discovered in real-world software and independently validated by project maintainers and security teams, these findings represent an outsized contribution from a relatively small, globally distributed company.
From AI-generated noise to trusted security findings
The cURL results are particularly noteworthy given Stenberg’s highly publicized concerns about the growing volume of low-quality AI-generated vulnerability reports. Earlier this year, cURL discontinued its bug bounty program after years of dealing with an increasing number of such submissions. In July, the project temporarily suspended vulnerability reporting to relieve pressure on its security team.
Yet following months of credible vulnerability discoveries by AISLE’s platform and research team, Stenberg requested a dedicated security review of cURL’s codebase in late August.
With cURL estimated to run in 30 billion installations and supported by a remarkably small core team, the cost of investigating inaccurate findings can be substantial. AISLE’s relationship with cURL began in late 2025, when its AI-powered analysis started identifying legitimate security and performance issues in the project’s codebase. Over time, the quality and consistency of those findings established the credibility that ultimately led to Stenberg’s request.
The latest results follow a series of earlier discoveries. In August, after other AI security systems had reported no additional vulnerabilities, AISLE submitted 29 findings to cURL. Of those, 28 were deemed valid, with six CVEs addressed in cURL’s previous release, and another 18 incorporated into the October 14 update.
“With AISLE, we have a cooperation unlike any we’ve had with a security organization before,” said Daniel Stenberg, founder and lead developer of the cURL project. “Their vast amount of detailed and accurate findings, backed up by a team of skilled humans, have made it possible for us to identify and fix more vulnerabilities in cURL at a faster rate than ever before, helping make the software more secure for the billions of people who rely on it, mostly indirectly, every day.”
“Five hundred assigned CVEs is an important milestone, but cURL is the stronger signal,” said Dr Stanislav Fort, co-founder, CTO and Chief Scientist at AISLE. “Frontier systems had already examined one of the world’s most scrutinized codebases, yet AISLE continued to find real vulnerabilities that maintainers reproduced and fixed. A small specialized team can keep pace with the world’s largest AI labs on this specific defensive task. The future of AI security will be decided by the complete system: discovery, triage, validation, remediation and maintainer collaboration. Model size alone will not decide it.”
A year of discoveries across critical software
The cURL findings are part of a broader record of AI-driven vulnerability discovery across widely deployed open-source and commercial software.
In its first year, AISLE’s platform and research team have identified more than 500 CVEs across over 100 codebases, including critical vulnerabilities in software that underpins essential technology infrastructure.
Among the notable results:
- OpenSSL: Across three security releases, AISLE discovered 20 of the 23 vulnerabilities disclosed by OpenSSL, with 10 AISLE-generated fixes accepted into official releases. AISLE was responsible for all 12 vulnerabilities addressed in OpenSSL’s January 2026 security release.
- FreeBSD: AISLE matched Anthropic with three CVEs each in the same release cycle, discovering its vulnerabilities after Anthropic’s original findings had been patched. AISLE uncovered critical vulnerabilities in the widely used operating system, including a remote code execution flaw that had gone undetected for approximately 20 years, as well as memory corruption vulnerabilities.
- FFmpeg: AISLE discovered 13 CVEs across two rounds of research in FFmpeg, the widely used multimedia processing framework. Six received High or Critical severity scores, and one stack overflow had remained in the code for 19 years. The findings highlight the potential impact of AI-powered security research on software components embedded in a broad range of applications and services.
- Additional projects: AISLE’s publicly documented discoveries span NASA CryptoLib, Cursor, Visual Studio Code, Wireshark, MySQL, MariaDB, PostgreSQL, and OpenEMR.
Taken together, these results show that AISLE’s AI system is not tuned to one codebase or one class of bug. It has produced maintainer-validated findings across cryptography, operating systems, media processing, healthcare, developer tools, and databases.
Why specialized AI systems can compete with frontier models
AISLE’s results highlight an increasingly important consideration in enterprise AI adoption: the effectiveness of AI systems depends on more than the size or sophistication of the underlying language models.
The company calls its approach “system over model.” Rather than relying on a single general-purpose AI model, AISLE combines specialized research, model selection, codebase context, parallel analysis, validation, and remediation into an integrated system designed for real-world security challenges.
This approach has enabled AISLE to produce significant findings in software projects already examined by some of the world’s most advanced AI systems from leading frontier labs
The UC Berkeley Vulnerability Initiative’s Agentic Vulnerability Coverage Map provides additional independent validation of AISLE’s research. Its leaderboard ranks AISLE first or tied for first across several measures of real-world vulnerability discovery, including total AI-attributed CVE volume, discoveries in the last 90 days, vulnerability classification breadth in terms of CWEs, and coverage of major software weakness categories in the MITRE CWE Top-25.
These rankings reflect validated zero-day vulnerability discoveries rather than general-purpose AI model capabilities, underscoring the importance of evaluating AI security systems on real-live, measurable outcomes rather than synthetic benchmarks.
Turning advanced security research into continuous protection
AISLE’s discoveries are driven by a dedicated research organization whose work directly informs the development and capabilities of the company’s commercial AI-native vulnerability lifecycle management platform.
AISLE applies its research to a continuously evolving platform that enables organizations to discover, triage, remediate, and verify software vulnerabilities autonomously.
This research-to-product approach is central to AISLE’s strategy. As new vulnerabilities are identified, models improve, and new security techniques emerge, AISLE incorporates those advances into its platform to strengthen the protection available to customers.
The distinction is increasingly important as AI accelerates vulnerability discovery. For enterprise security teams, identifying more potential vulnerabilities is only valuable if those findings can be validated, prioritized, and remediated efficiently.
AISLE’s platform addresses that challenge through an autonomous, closed-loop approach that produces root-cause analyses, validates findings, generates tested fixes, and supports coordinated disclosure.
During its first year, AISLE also became a CVE Numbering Authority and Researcher CNA under the ENISA Root. ENISA subsequently selected AISLE to continuously review the code supporting the vulnerability reporting platform behind Europe’s Cyber Resilience Act.
AISLE is also applying continuous security analysis to projects including OpenSSL, cURL, and OpenEMR, with the goal of identifying and fixing vulnerabilities before vulnerable code reaches users.
“One year ago, we launched AISLE with the conviction that AI could fundamentally change how software vulnerabilities are discovered and fixed,” said Ondrej Vlcek, CEO and co-founder of AISLE. “Today, with more than 500 validated CVEs across over 100 codebases, including some of the world’s most widely used software, we’re demonstrating what’s possible. But finding vulnerabilities is only part of the equation. Our ambition is to help the industry move beyond managing an ever-growing backlog of security issues to continuously eliminating them. That’s the challenge we’re focused on solving in our second year and beyond.”
For more information about AISLE’s research and the cURL audit, visit https://aisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship-today.
About AISLE™
AISLE is a pioneer in AI-native vulnerability lifecycle management, taking security teams from detection to verified, human-approved fixes, autonomously. Our closed-loop platform uncovers vulnerabilities that legacy tools miss, generates ready-to-merge patches, and gets smarter with every remediation cycle. Built to deploy across cloud, on-premises, and air-gapped environments, AISLE serves even the most regulated and security-sensitive industries. Learn more at aisle.com.
CONTACT: Media Contact AISLE Press Team press@aisle.com
