AI System Discovers 12 OpenSSL Zero-Days, Curl Cancels Bug Bounty Due to AI Spam
AISLE's automated AI system for cybersecurity discovery found all 12 zero-day vulnerabilities in OpenSSL's recent security release, while curl cancelled its bug bounty program due to AI-generated spam submissions. This represents the first real-world demonstration of AI-based cybersecurity at this scale against heavily audited infrastructure.
Key Details from the Source
The AI system discovered vulnerabilities in OpenSSL, which underpins encryption for at least two-thirds of the world's internet traffic. The system operates under the pseudonym "Giant Anteater" in bug bounty programs and aims to turn elite security research into a repeatable industrial process.
Previous results from Fall 2025 included:
- CVE-2025-9230: Out-of-bounds read/write in RFC 3211 KEK unwrap operation for CMS password-based encryption, potentially leading to memory corruption or code execution. This bug had been present since 2009.
- CVE-2025-9231: Timing side-channel in SM2 elliptic-curve signatures on 64-bit ARM, where execution time variations could allow private key recovery through remote observation.
- CVE-2025-9232: Out-of-bounds read in HTTP client no_proxy handling when parsing IPv6 hosts, triggering a controlled crash.
The system handles the full loop including scanning, analysis, triage, and exploit construction. OpenSSL maintainers are famously conservative about issuing CVEs, making their acceptance a stringent external benchmark.
Meanwhile, curl cancelled its bug bounty program due to a flood of AI-generated spam submissions, even as AISLE reported 5 genuine CVEs to them. This illustrates AI's dual impact: collapsing the median quality of submissions while raising the ceiling for discovering real zero-days in critical infrastructure.
The Frontier of the Year 2025 forecasting project placed AI-driven vulnerability discovery in critical infrastructure at #3 overall by expected impact, with a 0.9 probability of generalizing.
📖 Read the full source: HN AI Agents
👀 See Also
Open Source AI Tools Pose Security Risks Through 'Illusory Security Through Transparency'
A Reddit post warns about malware disguised as open-source AI agents and tools, where malicious code can be hidden in large codebases that users assume are safe because they're on GitHub. The post describes how 'vibe-coding' and autonomous AI agents condition users to run unknown programs without review.
arifOS: A $15 MCP Governance Kernel for OpenClaw Tool Security
arifOS is a lightweight MCP server that intercepts OpenClaw tool calls, scores them 000-999, and blocks unsafe actions with 13 hard security floors before they reach filesystems, APIs, or databases.
Caelguard: Open-Source Security Scanner for OpenClaw Instances
Caelguard is an open-source security scanner built for OpenClaw that runs 22 checks across your instance, including Docker isolation, tool permission scoping, and skill supply chain verification. It provides a score out of 140 with a letter grade and specific remediation steps.
Smart Bash Permission Hook for Claude Code Prevents Compound Command Bypass
A Python PreToolUse hook addresses a security gap in Claude Code's permission system where compound bash commands could bypass allow/deny patterns. The script decomposes commands into sub-commands and checks each individually against existing permission rules.