ZDNET’s key takeaways
- Aisle finds bugs that AI coding programs can’t.
- The best Linux maintainers are impressed.
- You should consider Aisle to help find bugs.
You may not have heard of Aisle, an AI-native vulnerability-management startup, but some of the best open-source maintainers know it well and really like it. Why? Because Aisle finds real bugs that other, far better-known AI coding programs, such as Anthropic’s Mythos and OpenAI’s Codex, don’t.
Also: OpenAI’s agents exploited a patched Linux bug in Hugging Face incident: 6 steps to take ASAP
For example, Aisle recently said its security analysis system uncovered six previously unknown vulnerabilities in Curl that the open-source project’s maintainers accepted and assigned Common Vulnerabilities and Exposures (CVE) numbers. The findings arrived shortly after Curl founder Daniel Stenberg wrote on Mastodon that Mythos, OpenAI Codex Security, and ZeroPath had found no additional vulnerabilities in the widely deployed, open-source networking file-transfer project. Aisle, meanwhile, found 29.
Aisle achieves this success not because it uses expensive frontier models, but because, the company states, “even small models can recognize a vulnerability when handed the right snippet of code with leading context.” We “tested whether cheap models with enough throughput can surface real bugs without that hand-holding. The answer was yes: adequately intelligent models, deployed systematically across an entire codebase, can surface real bugs without hand-scoped snippets.”
Stenberg was fine with Aisle’s discoveries. Unlike in the past, when AI programs discovered bogus vulnerabilities and produced mountains of AI slop reports, they now find real security holes. As Stenberg put it, we’re now in the “high quality chaos era.” Still, as Stenberg commented on Mastodon, “I am grateful that all the most powerful AI engines all scan #curl to find flaws. Finding them means we can fix them. Sometimes it just demands coming up to the surface for a few deep breaths before we dive again.”
Linux maintainers are impressed
It’s not just Curl, though, that’s reaping the benefits of Aisle. As Greg Kroah-Hartman, the maintainer of the Linux stable kernel, put it, “I’m seeing the same for Linux as well. No idea what Aisle is doing differently, but wow…”
Jim Fuller, a Red Hat senior principal software engineer specializing in security, speculates that Aisle knows what it’s doing, knows the limitations of tooling, and I suspect has worked harder than just running a scanner.
Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried
In an interview, Stenberg added, “I think at least a part of this success (for both of us) is our communication and cooperation. We’ve met, we’ve talked, and they spend proper engineering time to make sure that we get curated results of top quality, which motivates us to take every Aisle report seriously.”
Curl maintainers accepted six Aisle-reported vulnerabilities for the project’s latest release. All six issues were patched in Curl 8.22.0, which was released September 2. Curl’s own advisory database lists the six CVEs as low severity, while the project’s release notes list them among the 10 security vulnerabilities addressed in the release.
Now, the results shouldn’t be overstated. Six accepted low-severity CVEs from a single project and one testing sequence do not establish a general performance ranking among Aisle, Mythos, and Codex Security. That said, the Curl results are stronger evidence than a benchmark score or a capture-the-flag exercise because they involve current production code and external validation by the project’s maintainers.
System versus model
Aisle is using the Curl result to advance what it calls a “system over model” argument: that an AI security product’s results depend less on the raw capability of its underlying foundation model than on the surrounding system — its agent orchestration, codebase context, vulnerability hypotheses, validation loops, and workflows for reproducing and remediating candidate issues.
Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried
I buy this theory. A general-purpose model can be highly capable at reasoning about code yet produce uneven results when asked to inspect a large, mature project through a one-off scan. A specialized system can potentially gain an advantage by iterating over code paths, tracking configuration-specific behavior, correlating libraries and historical vulnerability patterns, ranking leads, and testing them before presenting a report.
Aisle’s platform claims to combine vulnerability discovery and triage with patch generation and verification. The startup’s broader pitch is not simply that AI can identify a bug, but that it can produce a developer-reviewable remediation and supporting validation, an effort to reduce the security team and maintainer labor required to turn alerts into merged fixes.
Maintainer approval matters
The more important lesson from the Curl episode may be methodological. Security tool comparisons often rely on benchmarks with known flaws, synthetic tasks, or the vendor’s internally verified results. Such tests are useful, but they say little about whether an AI system can find a subtle, previously unknown defect in code already exposed to years of real-world review.
Here, Curl’s maintainers, not Aisle, Anthropic, or OpenAI, controlled the decisive outcome. They reviewed reports, decided whether they represented security vulnerabilities, issued CVEs, created patches, and incorporated those fixes into a public release.
Also: AI a ‘force multiplier’ for low-skilled threat actors: 4 ways organizations should respond
The comparison is also more than a raw report count. Aisle initially reported 29 candidate issues, but only six cleared Curl’s security review bar as CVEs. That outcome does not make the remaining 23 issues useless. Some may be ordinary bugs, false positives, duplicates, or still-under-review reports. However, the result underscores why “findings” and “confirmed vulnerabilities” should not be treated as interchangeable.
So, Aisle’s performance on Curl offers a meaningful early result for specialized, agentic security systems: on one of open source’s most hardened C codebases. Whether the outcome proves repeatable across other projects, languages, and operational environments remains the next question.
Be that as it may, when Stenberg, Kroah-Hartman, and Fuller, all of whom know finding and fixing security bugs like the back of their hands, are impressed, I’m impressed, too. If you’re serious about finding and fixing vulnerabilities, Aisle demands your attention.
