- Book: AI Agents Pocket Guide
- Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
In January, curl shut down its bug bounty after a week in which seven reports came in and none described a vulnerability. Lead developer Daniel Stenberg said the aim was to remove the incentive for "crap and non-well researched reports to us. AI generated or not." Nine months later, on October 14, curl 8.23.0 shipped with 24 security fixes. Read the credit lines on the 24 advisories and 20 of them point to AI-assisted research. Eighteen go to the AI security company AISLE, and 2 to Anthropic, including the only one rated High.
This time the AI-assisted reports held up: the curl security team confirmed them, and the project cut a release cycle short to ship the fixes.
What shipped in curl 8.23.0
Stenberg's release post lists 24 security fixes, 281 bugfixes and 476 commits, 42 days after curl 8.22.0 on September 2. Two changes to note before you upgrade: SMB(S) support is removed from curl and libcurl, and CURL_GLOBAL_WIN32 is deprecated in favour of CURL_GLOBAL_WINSOCK (release post).
On the security page, 23 of the 24 new advisories are rated Low and one is rated High. The list is mostly logic bugs around credentials and state: Negotiate credentials sent to a redirected origin, host credentials leaked to an HTTP proxy, a password leak in CURLINFO_EFFECTIVE_URL, HSTS entries erased by a response, a wolfSSL public-key pinning bypass. Some are old. The proxy credential leak, CVE-2026-86414, affects every version from 7.10.8 through 8.22.0.
Most of the bugs curl fixed on October 14 were spotted by machine-assisted audits, then confirmed by the curl security team.
Who found what
The credit line on each advisory names the reporter. Grouped:
| Reporter | CVEs in 8.23.0 | Severity |
|---|---|---|
| AISLE Research | 18 | All Low |
| Anthropic, credited "with Claude" | 2 | 1 High, 1 Low |
| Individual researchers | 4 | All Low |
AISLE lists its 18 CVE IDs in its own write-up, and the advisories match, for example CVE-2026-86414 credits "Aisle Research". Anthropic's two are CVE-2026-92392, the High one, and CVE-2026-107928, an info leak when uploading over WebSockets with GnuTLS. Both credit lines read "with Claude, Anthropic". The other four advisories, such as CVE-2026-107929, credit individual reporters and say nothing about tooling.
AISLE has done this before. It says it found six of the CVEs fixed in 8.22.0. Stenberg's own post on the AISLE audit puts the total over roughly the last year at "no less than thirty-five published curl vulnerabilities and CVE Ids", and says the work has helped the project fix vulnerabilities "at a higher rate than ever before."
The High one: an HTTP/2 upload use-after-free
CVE-2026-92392 affects curl 8.12.0 through 8.22.0, the command line tool included. The advisory says curl "mishandles HTTP/2 RST_STREAM received from the server" with the reasons HTTP_1_1_REQUIRED or REFUSED_STREAM, which leads to a use-after-free of a struct Curl_easy. It was reported on September 15.
Stenberg calls it "one of the worst vulnerabilities in curl in a long time" in a separate write-up. The advisory says it "has been proven to be possible to convert into a Remote Code Execution". The conditions, spread across the advisory and that write-up, are narrow: the victim uploads roughly 135KB to a malicious server whose certificate still validates, the attacker needs "a known and compatible libc allocator build and heap layout", and the payload area is only about 23 bytes. Stenberg's estimate: "The most likely outcome of an attempted attack is rather just a crash", and "the chance for a successful attack is slim." curl rates it High, not Critical.
He writes that the bug was found by an Anthropic researcher "using their new OSS Scanner", adding "Presumably this involves their AI models." The team confirmed it within hours and cut the release cycle from eight weeks to six to ship the fix (same post).
Stenberg also rules out a rewrite: "We do not rewrite curl. Not into another language but also not in C," he writes (write-up). Instead, curl is storing transfer identifiers in place of internal pointers to handles, and adding tests and analyzers.
Reviewed reports and a new unreviewed channel
Both vendors used models, and in both cases a person filed the curl reports. AISLE says "an AISLE security researcher reviews the complete report before submission", and that curl's security team then decides on its own whether each finding is real, how severe it is and whether it gets a CVE (AISLE). Anthropic's two came from a named Anthropic researcher, credited "with Claude" on the advisories.
What differs is the public service Anthropic opened on October 8. Its OSS Scanner works the other way: "The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage." Anthropic says its scanning over the past six months produced over 29,000 candidate vulnerabilities, about 6,000 of which were manually reviewed and triaged. The service is opt-in, free and inspired by Google's OSS-Fuzz, and maintainers enrol by opening a pull request against anthropics/oss-scanner. The Hacker News reports that the config points to a Dockerfile that builds the project for an offline agent, and that Anthropic will not impose a 90-day disclosure deadline on unreviewed findings.
One stated policy puts a human between the model and the maintainer; Anthropic's opt-in service promises the raw output.
If you enrol your project, what the service sends you is, in Anthropic's words, output "without human review or triage", and sorting real bugs from false ones is your job. curl's January bounty shutdown shows what a stream of unverified reports costs a small team (The Register).
What to check this week
The advisory's first recommendation is to upgrade to 8.23.0. It also lists fixed point releases if you are pinned to an older branch: 8.20.2, 8.16.2 and 8.14.3 (CVE-2026-92392). Distro packages may carry backported patches under an older version number, so check your vendor's advisory rather than the number alone.
The tricky part is libcurl, which the advisory notes is used by many applications that do not always advertise it. Check more than the CLI on your PATH:
curl --version | head -n 1
# libcurl your C builds compile against (runtime may differ)
curl-config --version
# libcurl inside PHP, and Python if you use pycurl
php -r 'echo curl_version()["version"], PHP_EOL;'
python3 -c 'import pycurl; print(pycurl.version)'
# inside a container image you ship
docker run --rm --entrypoint curl your-image:tag --version
If you cannot upgrade right away, the advisory's third option is "Do not use HTTP/2". On the command line that is --http1.1; in libcurl it is CURLOPT_HTTP_VERSION:
curl_easy_setopt(h, CURLOPT_HTTP_VERSION,
(long)CURL_HTTP_VERSION_1_1);
That covers the High one only. The 23 Low fixes need the upgrade or a patched build.
Would you opt your own project into a scanner that sends model output without a human check? Tell me in the comments.
If this was useful
I build Hermes IDE, so weigh this with that in mind. If you point Claude Code, Codex or another coding agent at your own repo to hunt for bugs like these, Hermes runs each one on its own branch and worktree, and its Review Desk lets you read every change turn by turn before you land it. It is free, source-available and on GitHub. If you build agents yourself, the AI Agents Pocket Guide covers the loop, tool and guardrail patterns that agents like these are built from.
Top comments (0)