curl AI Security: AISLE Finds CVEs After Bounty Shutdown

What happened

The curl project ended its paid bug bounty in January 2026 after being swamped by low-quality, AI-generated vulnerability reports 3. The same AI tooling that helped drive that decision is now part of how curl hunts for flaws.

According to AISLE, an AI cybersecurity company, its autonomous platform was credited with 24 curl pull requests and five security issues that received CVE identifiers in the months before the bounty was retired, for 29 valid findings 2. The five CVEs it lists include a path traversal in wcurl using percent-encoded slashes, a QUIC pinned public key bypass, broken TLS options for threaded LDAPS, and an OpenSSL partial chain store policy bypass 2. AISLE says curl now uses its AI to secure the codebase 2. That account comes from the vendor's own announcement and not from the curl project.

A second round followed. On August 24, 2026, curl founder Daniel Stenberg posted that only three CVEs were pending for the next release. He added that Anthropic's Mythos said it could not find any more and that OpenAI's Codex Security returned an empty list 1. AISLE says it then ran its system against curl and filed 29 reports, which led to six more CVEs within days of those zero-result scans 1. AISLE frames this as beating frontier labs on one of the most heavily audited codebases in the world, software it says runs in more than 20 billion instances 1.

The slop problem that killed the bounty

The background is a broad collapse in trust in crowdsourced vulnerability reporting. Stenberg has estimated that about 20% of curl's 2025 reports were AI slop. HackerOne reported AI-related vulnerability submissions up 210% year over year. Screenly confirmed only 39 of 331 reports it received as real 3. Every one of those submissions has to be read by a human, whether it describes a real bug or a hallucinated one 3.

curl was an early program to fold under that load, and it has not been the only one. Google began rejecting reports generated solely by AI in March 2026 3 and paused its open-source vulnerability reward program 4. Intel suspended a bounty that paid up to $100,000 per flaw 4. GitHub is restructuring its program from July 27, 2026, around an invite-only VIP tier and a cap of four submissions for new researchers 3. Linux kernel maintainers have described themselves as "completely overwhelmed" as AI-driven CVE output approaches 2,000 per release 4.

Where the accounts diverge

One data point in this coverage seems to cut against AISLE's story. A six-year sample of curl submissions reportedly found zero genuine bugs from AI-only reports 3. That is hard to square with AISLE's claim of five CVEs 2.

The likeliest explanation is a difference in category. "AI-only submissions" usually means someone pasting chatbot output into a bounty form. AISLE describes an autonomous analysis pipeline whose findings were turned into actual patches. Stenberg himself is quoted as saying "a new breed of analyzer" had emerged 2. The numbers don't fully contradict each other, but they show how loosely "AI-found" is used.

The counts also deserve care. AISLE reports 29 valid findings with five CVEs in its first round 2 and 29 reports with six CVEs in its second 1. These are separate batches, and both totals come from the company's own marketing. They have not been independently audited. The comparison with Mythos and Codex Security rests on one maintainer's short public post 1. It shows what those tools reported on one occasion, not a controlled benchmark.

Why it matters

The broader argument across this coverage is that the trouble lies with incentives and triage capacity, not with AI's ability to find bugs 4. AISLE also claims it found all 12 OpenSSL zero-days disclosed in January 2026 4. If that holds up, the same technology produces both the noise and some of the best signal.

Bug bounties pay for volume and for being first, and cheap generation tools exploit that structure. Verification costs fall entirely on maintainers. One suggested fix is to stop trying to ban AI and instead reward verified findings over sheer submission count 3. curl's path fits that idea: it shut off the open firehose, then reportedly brought in a single vetted source whose output arrives as reviewed patches.

My reading is that curl's move points to where open-source security is heading. Expect fewer open bounties and more curated relationships with tools and researchers who have a track record. That raises a fair question about vendor concentration. Projects like curl may come to depend on a few commercial AI firms whose claims are hard to check from outside. Still, the curl case shows that AI-assisted discovery has to be judged by confirmed CVEs and merged fixes, not by how many reports a tool can generate.