← Notescybersecurity · research
AI found twelve OpenSSL bugs the same month curl gave up on AI bug reports
Two things happened within a day of each other in January 2026, and together they say a lot about AI in security.
The good: twelve out of twelve
On 27 January, OpenSSL published a security release fixing 12 vulnerabilities. All twelve were found by AISLE, a company whose AI system hunts for bugs (LessWrong write-up). One was rated high severity: a stack buffer overflow in CMS parsing that happens before any cryptographic check. The rest were moderate or low.
OpenSSL is one of the most audited codebases in existence. An automated system finding every bug in a release is not a demo, it’s a result.
The bad: curl closes its bounty
The day before, on 26 January, Daniel Stenberg announced the end of curl’s bug bounty. It had run since 2019 and paid out over $90,000 for 81 real vulnerabilities (same source). It ended because of a flood of low-quality, AI-generated reports. Stenberg had estimated earlier that about 20% of submissions were AI slop and only around 5% of the year’s reports were genuine vulnerabilities.
The twist: during the same period AISLE’s reports turned into real curl CVEs, three of the six fixed in curl 8.18.0.
Same tools, different operators
The difference between the two stories isn’t the technology. It’s whether someone checked the output before sending it. A model that suggests a possible bug is cheap. A verified, reproducible report is still expensive, and maintainers’ time is the scarcest resource in open source.
Attackers read the same papers
Defenders aren’t the only ones using this. In May, Google’s threat intelligence group reported the first zero-day exploit in the wild that it believes was developed with AI: a Python script that bypassed two-factor authentication on a popular open-source admin tool (Google Cloud). The giveaway was the style: tidy textbook Python, lots of explanatory docstrings, and a CVSS score that didn’t exist. They believe it was found before the planned mass exploitation.
The same report describes attackers compromising AI tooling the old-fashioned way, through poisoned packages and malicious pull requests, including in LiteLLM, a popular AI gateway library.
My takeaway: AI makes finding bugs cheaper for everyone. Whether that helps defenders more depends on who does the boring part, verifying and fixing, faster.