Aisle detects 6 security vulnerabilities in Curl that Mythos and Codex missed

Summary

AI-based security vulnerability management startup Aisle identified six verified CVEs in Curl that were missed by Anthropic's Mythos and OpenAI's Codex Security tools. This achievement earned public praise from Curl's founder and Linux stable maintainer Greg Kroah-Hartman.

Why it matters

This challenges the common assumption that the most expensive frontier models are automatically the best choice for security audits. It suggests that a well-orchestrated system with targeted context can outperform raw model capabilities. Additionally, it highlights Aisle's transition into what Stenberg calls the 'era of high-quality chaos,' marking a departure from previous periods where AI security tools overwhelmed maintainers with false positives.

Highlights

• All six CVEs were of low severity and were patched in Curl version 8.22.0 (September 2).
• Aisle argues that smaller models with the right code context for this task outperformed expensive frontier models.
• Stenberg from Curl and Kroah-Hartman from Linux publicly validated the findings, a rare sign of real-world verification.

Critical take

The article warns that six low-severity CVEs from a single test cycle on one project cannot establish a general performance ranking. Furthermore, Aisle's 'system over model' framework provides convenient ground for praising its own architecture. The text offers no independent method review or reproducibility check.