Afte ea ly a yea of c edible vul e ability discove ies, cURL fou de Da iel Ste be g asked AISLE to co duct a comp ehe sive secu ity eview; the compa y’s AI- ative platfo m has su passed 500 validated CVEs ac oss mo e tha 100 codebases
SAN FRANCISCO a d PRAGUE, Oct. 14, 2026 (GLOBE NEWSWIRE) — AISLE, a pio ee i AI- ative vul e ability lifecycle ma ageme t, today a ou ced that vul e abilities discove ed by its AI-powe ed secu ity platfo m accou ted fo 18 of the 24 CVEs add essed i cURL’s Octobe 14 elease, ep ese ti g 75% of the total. The fi di gs follow ea ly a yea of collabo atio du i g which AISLE co siste tly ide tified legitimate secu ity vul e abilities, p ompti g cURL fou de Da iel Ste be g to equest a comp ehe sive secu ity eview. Ste be g c edits the collabo atio with helpi g cURL ide tify a d fix mo e vul e abilities faste tha eve befo e.
AISLE has ide tified a cumulative total of 35 CVEs a d 160 additio al secu ity a d pe fo ma ce bugs i cURL, o e of the wo ld’s most widely deployed softwa e compo e ts. Amo g those discove ies was a authe ticatio vul e ability dati g back 25 yea s, demo st ati g the pote tial of specialized AI to u cove secu ity weak esses i eve the most matu e a d exte sively sc uti ized codebases.
The latest cURL discove ies also coi cide with a sig ifica t milesto e fo AISLE: mo e tha 500 assig ed CVEs ac oss ove 100 codebases i its fi st yea si ce eme gi g f om stealth. Discove ed i eal-wo ld softwa e a d i depe de tly validated by p oject mai tai e s a d secu ity teams, these fi di gs ep ese t a outsized co t ibutio f om a elatively small, globally dist ibuted compa y.
The cURL esults a e pa ticula ly otewo thy give Ste be g’s highly publicized co ce s about the g owi g volume of low-quality AI-ge e ated vul e ability epo ts. Ea lie this yea , cURL disco ti ued its bug bou ty p og am afte yea s of deali g with a i c easi g umbe of such submissio s. I July, the p oject tempo a ily suspe ded vul e ability epo ti g to elieve p essu e o its secu ity team.
Yet followi g mo ths of c edible vul e ability discove ies by AISLE’s platfo m a d esea ch team, Ste be g equested a dedicated secu ity eview of cURL’s codebase i late August.
With cURL estimated to u i 30 billio i stallatio s a d suppo ted by a ema kably small co e team, the cost of i vestigati g i accu ate fi di gs ca be substa tial. AISLE’s elatio ship with cURL bega i late 2025, whe its AI-powe ed a alysis sta ted ide tifyi g legitimate secu ity a d pe fo ma ce issues i the p oject’s codebase. Ove time, the quality a d co siste cy of those fi di gs established the c edibility that ultimately led to Ste be g’s equest.
The latest esults follow a se ies of ea lie discove ies. I August, afte othe AI secu ity systems had epo ted o additio al vul e abilities, AISLE submitted 29 fi di gs to cURL. Of those, 28 we e deemed valid, with six CVEs add essed i cURL’s p evious elease, a d a othe 18 i co po ated i to the Octobe 14 update.
“With AISLE, we have a coope atio u like a y we’ve had with a secu ity o ga izatio befo e,” said Da iel Ste be g, fou de a d lead develope of the cURL p oject. “Thei vast amou t of detailed a d accu ate fi di gs, backed up by a team of skilled huma s, have made it possible fo us to ide tify a d fix mo e vul e abilities i cURL at a faste ate tha eve befo e, helpi g make the softwa e mo e secu e fo the billio s of people who ely o it, mostly i di ectly, eve y day.”
“Five hu d ed assig ed CVEs is a impo ta t milesto e, but cURL is the st o ge sig al,” said D Sta islav Fo t, co-fou de , CTO a d Chief Scie tist at AISLE. “F o tie systems had al eady exami ed o e of the wo ld’s most sc uti ized codebases, yet AISLE co ti ued to fi d eal vul e abilities that mai tai e s ep oduced a d fixed. A small specialized team ca keep pace with the wo ld’s la gest AI labs o this specific defe sive task. The futu e of AI secu ity will be decided by the complete system: discove y, t iage, validatio , emediatio a d mai tai e collabo atio . Model size alo e will ot decide it.”
The cURL fi di gs a e pa t of a b oade eco d of AI-d ive vul e ability discove y ac oss widely deployed ope -sou ce a d comme cial softwa e.
I its fi st yea , AISLE’s platfo m a d esea ch team have ide tified mo e tha 500 CVEs ac oss ove 100 codebases, i cludi g c itical vul e abilities i softwa e that u de pi s esse tial tech ology i f ast uctu e.
Amo g the otable esults:
Ope SSL: Ac oss th ee secu ity eleases, AISLE discove ed 20 of the 23 vul e abilities disclosed by Ope SSL, with 10 AISLE-ge e ated fixes accepted i to official eleases. AISLE was espo sible fo all 12 vul e abilities add essed i Ope SSL’s Ja ua y 2026 secu ity elease.F eeBSD: AISLE matched A th opic with th ee CVEs each i the same elease cycle, discove i g its vul e abilities afte A th opic’s o igi al fi di gs had bee patched. AISLE u cove ed c itical vul e abilities i the widely used ope ati g system, i cludi g a emote code executio flaw that had go e u detected fo app oximately 20 yea s, as well as memo y co uptio vul e abilities.FFmpeg: AISLE discove ed 13 CVEs ac oss two ou ds of esea ch i FFmpeg, the widely used multimedia p ocessi g f amewo k. Six eceived High o C itical seve ity sco es, a d o e stack ove flow had emai ed i the code fo 19 yea s. The fi di gs highlight the pote tial impact of AI-powe ed secu ity esea ch o softwa e compo e ts embedded i a b oad a ge of applicatio s a d se vices.Additio al p ojects: AISLE’s publicly docume ted discove ies spa NASA C yptoLib, Cu so , Visual Studio Code, Wi esha k, MySQL, Ma iaDB, Postg eSQL, a d Ope EMR.
Take togethe , these esults show that AISLE’s AI system is ot tu ed to o e codebase o o e class of bug. It has p oduced mai tai e -validated fi di gs ac oss c yptog aphy, ope ati g systems, media p ocessi g, healthca e, develope tools, a d databases.
AISLE’s esults highlight a i c easi gly impo ta t co side atio i e te p ise AI adoptio : the effective ess of AI systems depe ds o mo e tha the size o sophisticatio of the u de lyi g la guage models.
The compa y calls its app oach “system ove model.” Rathe tha elyi g o a si gle ge e al-pu pose AI model, AISLE combi es specialized esea ch, model selectio , codebase co text, pa allel a alysis, validatio , a d emediatio i to a i teg ated system desig ed fo eal-wo ld secu ity challe ges.
This app oach has e abled AISLE to p oduce sig ifica t fi di gs i softwa e p ojects al eady exami ed by some of the wo ld’s most adva ced AI systems f om leadi g f o tie labs
The UC Be keley Vul e ability I itiative’s Age tic Vul e ability Cove age Map p ovides additio al i depe de t validatio of AISLE’s esea ch. Its leade boa d a ks AISLE fi st o tied fo fi st ac oss seve al measu es of eal-wo ld vul e ability discove y, i cludi g total AI-att ibuted CVE volume, discove ies i the last 90 days, vul e ability classificatio b eadth i te ms of CWEs, a d cove age of majo softwa e weak ess catego ies i the MITRE CWE Top-25.
These a ki gs eflect validated ze o-day vul e ability discove ies athe tha ge e al-pu pose AI model capabilities, u de sco i g the impo ta ce of evaluati g AI secu ity systems o eal-live, measu able outcomes athe tha sy thetic be chma ks.
AISLE’s discove ies a e d ive by a dedicated esea ch o ga izatio whose wo k di ectly i fo ms the developme t a d capabilities of the compa y’s comme cial AI- ative vul e ability lifecycle ma ageme t platfo m.
AISLE applies its esea ch to a co ti uously evolvi g platfo m that e ables o ga izatio s to discove , t iage, emediate, a d ve ify softwa e vul e abilities auto omously.
This esea ch-to-p oduct app oach is ce t al to AISLE’s st ategy. As ew vul e abilities a e ide tified, models imp ove, a d ew secu ity tech iques eme ge, AISLE i co po ates those adva ces i to its platfo m to st e gthe the p otectio available to custome s.
The disti ctio is i c easi gly impo ta t as AI accele ates vul e ability discove y. Fo e te p ise secu ity teams, ide tifyi g mo e pote tial vul e abilities is o ly valuable if those fi di gs ca be validated, p io itized, a d emediated efficie tly.
AISLE’s platfo m add esses that challe ge th ough a auto omous, closed-loop app oach that p oduces oot-cause a alyses, validates fi di gs, ge e ates tested fixes, a d suppo ts coo di ated disclosu e.
Du i g its fi st yea , AISLE also became a CVE Numbe i g Autho ity a d Resea che CNA u de the ENISA Root. ENISA subseque tly selected AISLE to co ti uously eview the code suppo ti g the vul e ability epo ti g platfo m behi d Eu ope’s Cybe Resilie ce Act.
AISLE is also applyi g co ti uous secu ity a alysis to p ojects i cludi g Ope SSL, cURL, a d Ope EMR, with the goal of ide tifyi g a d fixi g vul e abilities befo e vul e able code eaches use s.
“O e yea ago, we lau ched AISLE with the co victio that AI could fu dame tally cha ge how softwa e vul e abilities a e discove ed a d fixed,” said O d ej Vlcek, CEO a d co-fou de of AISLE. “Today, with mo e tha 500 validated CVEs ac oss ove 100 codebases, i cludi g some of the wo ld’s most widely used softwa e, we’ e demo st ati g what’s possible. But fi di g vul e abilities is o ly pa t of the equatio . Ou ambitio is to help the i dust y move beyo d ma agi g a eve -g owi g backlog of secu ity issues to co ti uously elimi ati g them. That’s the challe ge we’ e focused o solvi g i ou seco d yea a d beyo d.”
Fo mo e i fo matio about AISLE’s esea ch a d the cURL audit, visit https://aisle.com/blog/o e-aisle-cu l-audit-p oduced-24-cves-18-ship-today.
AISLE is a pio ee i AI- ative vul e ability lifecycle ma ageme t, taki g secu ity teams f om detectio to ve ified, huma -app oved fixes, auto omously. Ou closed-loop platfo m u cove s vul e abilities that legacy tools miss, ge e ates eady-to-me ge patches, a d gets sma te with eve y emediatio cycle. Built to deploy ac oss cloud, o -p emises, a d ai -gapped e vi o me ts, AISLE se ves eve the most egulated a d secu ity-se sitive i dust ies. Lea mo e at aisle.com.
CONTACT: Media Co tact
AISLE P ess Team
p ess@aisle.com
