This is a partial follow-up to AISLE discovered three new OpenSSL vulnerabilities from October 2025.

TL;DR: OpenSSL is among the most scrutinized and audited cryptographic libraries on the planet, underpinning encryption for most of the internet. They just announced 12 new zero-day vulnerabilities (meaning previously unknown to maintainers at time of disclosure). We at AISLE discovered all 12 using our AI system. This is a historically unusual count and the first real-world demonstration of AI-based cybersecurity at this scale. Meanwhile, curl just cancelled its bug bounty program due to a flood of AI-generated spam, even as we reported 5 genuine CVEs to them. AI is simultaneously collapsing the median ("slop") and raising the ceiling (real zero-days in critical infrastructure).

Background

We at AISLE have been building an automated AI system for deep cybersecurity discovery and remediation, sometimes operating in bug bounties under the pseudonym Giant Anteater. Our goal was to turn what used to be an elite, artisanal hacker craft into a repeatable industrial process. We do this to secure the software infrastructure of human civilization before strong AI systems become ubiquitous. Prosaically, we want to make sure we don't get hacked into oblivion the moment they come online.

No reliable cybersecurity benchmark reaching the desired performance level exists yet. We therefore decided to test the performance of our AI system against live targets. The clear benefit of this is that for a new, zero-day security vulnerability to be accepted as meriting a CVE (a unique vulnerability identifier), it has to pass an extremely stringent judgement by the long-term maintainers and security team of the project, who are working under many incentives not to do so. Beyond just finding bugs, the issue must fit within the project's security posture, i.e. what they consider important enough to warrant a CVE. OpenSSL is famously conservative here. Many reported issues are fixed quietly or rejected entirely. Therefore our "benchmark" was completely external to us, and in some cases intellectually adversarial.

We chose to focus on some of the most well-audited, secure, and heavily tested pillars of the world's software ecosystem. Among them, OpenSSL stands out. Industry estimates suggest that at least 2/3 of the world's internet traffic is encrypted using OpenSSL, and a single zero-day ...

Def Derrer

Def Derrer