AISLE found six curl CVEs days after two vendor systems reported zero on the same code.

Stanislav Fort published on September 2 that AISLE's autonomous system produced 29 reports against curl, after curl founder Daniel Stenberg had posted publicly on August 24 that Mythos "can't find any more" and Codex security "shows an empty list." Six were accepted by curl's security team and assigned CVEs in 8.22.0, covering an OpenSSL provider use-after-free, a pinning bypass, CA-store connection reuse, a tab-based secure-attribute bypass, a wolfSSL CA-cache callback override, and a domain-scoped public-suffix cookie bug. All six rated Low. The count matters less than the setup: the zero-result baseline was public and timestamped before AISLE ran, and curl's maintainers decided what counted. That's a cleaner methodology than most AI security claims get.