curl just shipped its largest CVE release ever, and one of the bugs had been sitting in the codebase since March 2001. Version 7.7. Twenty five years of shipping on roughly 30 billion devices before anyone noticed.

It wasn''t a human who noticed. A startup called AISLE ran autonomous agents against the production codebase and filed 29 reports. Six were accepted as CVEs by curl''s own maintainers. Three were patched using fixes the platform generated. All six were rated Low, which matters less than the fact that they were real and had survived decades of human review, fuzzing, and static analysis.

The part everyone is quoting is that OpenAI''s Codex Security and Anthropic''s Mythos both ran the same codebase and publicly returned zero findings. That reads like a leaderboard result. It''s more useful as evidence that vulnerability discovery is not a model capability question. It''s a harness question. Same class of model, same target, wildly different output, because the scaffolding around the model does the actual work.

The number nobody is talking about is 23

Twenty nine reports in. Six accepted. That is roughly a 20% hit rate, and it is genuinely good for automated security research. It also means 23 reports landed in a queue that a human had to read, reason about, and close.

curl has Daniel Stenberg. He has been vocal for years about the flood of low quality AI security reports drowning the project, and he has the standing to reject them fast. Your team does not have that. If you point a scanner like this at your own codebase, you have just created a triage job, and nobody on your roadmap owns it.

This is where most teams get the economics wrong. They evaluate security tooling on recall, because finding the bug is the exciting part. The cost is precision. A tool that finds three real issues and 90 false ones will get muted inside a month, and then it finds nothing at all, because nobody reads the output.

Track two numbers before you commit to any of these platforms:

Acceptance rate. Reports confirmed as real, divided by reports filed. Under 10% and your engineers will stop opening the tickets.
Time to close a rejection. How long it takes one engineer to read a false positive and dismiss it with confidence. If that''s 40 minutes because the report has no reproduction path, the tool is costing you more than it saves.

Your dependencies are about to get noisier

Here''s the second order effect. AISLE also reports finding all 12 of a set of OpenSSL vulnerabilities. curl has now adopted the tooling directly. Other critical projects will follow, because the alternative is waiting for someone to find these bugs the slow way.

That means a wave of CVEs in libraries you already ship. Not new bugs. Old bugs, finally surfaced. Your dependency scanner is going to start screaming about packages that were quietly fine last quarter.

The teams that handle this well won''t be the ones with the best scanner. They''ll be the ones who can already answer two questions in under an hour: which services actually use this library, and how fast can we ship a patched version to all of them. If updating a transitive dependency requires a manual release across six repos, the CVE volume increase is going to hurt.

So the practical work here isn''t buying a tool. It''s the boring infrastructure: an accurate SBOM, automated dependency updates that actually merge, and a deploy pipeline you trust enough to run on a Friday afternoon when something Critical drops.

What we''d actually do

If you''re a small team, don''t run an autonomous security agent against your whole codebase yet. Scope it to the parts that parse untrusted input, because that''s where memory and logic bugs live and where the signal to noise ratio is best. Give one person ownership of the output for a fixed trial period. Measure the two numbers above. Then decide.

And patch curl. The 25 year old bug is in your stack somewhere.

We''re here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you''re looking to build something, get in contact with us today!