Six curl CVEs after OpenAI and Anthropic came back with zero
Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated.
When curl handed its codebase to OpenAI and Anthropic models to hunt for vulnerabilities, both came back empty—yet human researchers subsequently found six real CVEs in the same code. If you're relying on LLM-based scanners as a security gate in your pipeline, treat a clean report as noise, not signal: current frontier models miss exploitable bugs that experienced humans catch, so they can't replace manual review or fuzzing for anything that ships to production.
curl just patched six new CVEs in a single release, meaning any production agent or LLM that shells out to curl (or any library that wraps it) is now running a known-vulnerable version. If you’re piping untrusted input into curl commands or parsing its output, you’re exposed to RCE, data leaks, or SSRF—update the binary, rebuild the container, and audit every call site within the next 24 hours.