AISLE
Sources: aisle.com · 12-of-12 OpenSSL blog post · Schneier on Security commentary
What
AI-native cybersecurity platform company building an autonomous analyzer that discovers — and proposes fixes for — vulnerabilities in widely deployed open-source software. The company positions itself against the “Shift Left” SAST genealogy with a “Shift to AI” framing (per Ondrej Burianek’s testimonial on the homepage). Tagline: “Zero is Everything” — autonomous vulnerability discovery + remediation at scale.
Relevance to This Wiki
AISLE is the wiki’s anchor entity for AI-driven discovery of decade-class latent vulnerabilities in widely deployed open-source cryptographic infrastructure. Three signal disclosures so far:
- 12 of 12 OpenSSL CVEs in the January 2026 coordinated release — including CVE-2025-15467, a CVSS 9.8 stack-buffer-overflow in CMS AuthEnvelopedData parsing dating to 1998. See the dedicated paper page. Spans 8+ subsystems (CMS, QUIC, TLS 1.3, post-quantum ML-DSA signatures, PKCS#12, OCB, TimeStamp, PKCS#7).
- 5 CVEs in curl plus a follow-on partnership: “curl Now Uses Our AI to Secure Its Code” (May 13, 2026; Joshua Rogers writing for AISLE). Materially significant because the Mythos-ready briefing cited curl’s earlier discontinuation of its bug bounty over AI-generated “slop” — the AISLE-curl partnership is the operational resolution to that pattern: AI-supported quality findings rather than AI-generated noise.
- CVE-2026-42511 — a 21-year-old FreeBSD remote-command-execution vulnerability (May 7, 2026; Joshua Rogers blog post).
Per Bruce Schneier’s testimonial on the AISLE homepage: “AISLE is credited for surfacing 13 of 14 OpenSSL CVEs assigned in 2025, and 15 total across both releases. This is a historically unusual concentration for any single research team, let alone an AI-driven one.”
Position relative to peer instruments on the ai-vuln-discovery axis:
| Instrument | Domain | Primary FP-control mechanism (per Adversarial Reflexion) |
|---|---|---|
| OpenAnt (Knostic, OSS) | App-code vuln discovery | Constrained-attacker-persona + explicit trace + tool-use verification |
| Codex Security / Aardvark (OpenAI) | App-code vuln discovery | Sandboxed exploit-trigger validation |
| Claude Code Security (Anthropic) | App-code vuln discovery | Self-critique prove/disprove |
| MDASH (Microsoft) | App-code vuln discovery | Ensemble + debater + prover-stage |
| AISLE | App-code vuln discovery (esp. cryptographic libraries) | Not publicly disclosed — proprietary autonomous analyzer. Reports include reproduction steps + root-cause analysis + concrete patch proposals (5 of 12 OpenSSL fixes incorporated directly). |
People
- Stanislav Fort — AISLE Research; author of the 12-of-12 OpenSSL disclosure and “AI Cybersecurity After Mythos: The Jagged Frontier” (April 7, 2026; same day as Mythos Preview release).
- Petr Šimeček, Tomas Dulka, Luigino Camastra — AISLE researchers contributing to the OpenSSL discoveries (per the blog post acknowledgments).
- Joshua Rogers — AISLE blog author; wrote the curl-partnership and FreeBSD CVE-2026-42511 posts.
Endorsements
Publicly testimonial endorsements from:
- Bruce Schneier (Inrupt; Harvard Kennedy School) — historically-unusual-concentration framing.
- J. Michael Daniel — vulnerability management framing.
- Aernout Reijmer — perfect-storm framing (overstretched teams + shrinking exploit time + rising regulation).
- Daniel Stenberg — curl creator; “An excellent new project. A powerful analyzer that highlights code areas that need more attention in ways the old generation of code tools have not been able to.”
- Ataccama, Ondrej Burianek, David Dolezal — practitioner endorsements.
Adjacent / Open
- Funding, headcount, founding date not captured in current ingest — pending follow-up.
- The “autonomous analyzer” architecture is not publicly disclosed (no peer to OpenAnt’s six-stage pipeline or Aardvark’s four-stage pipeline). The FP-control mechanism category for AISLE is empty in the wiki’s cross-product comparison until AISLE publishes architectural detail.
- The Stanislav Fort “Jagged Frontier” post (April 7, 2026) — same-day commentary on Mythos. Worth a dedicated paper page if the frontier-AI thesis picks up its framing.
- AISLE on the [[unprompted-conference-march-2026|[un]prompted March 2026]] key-claim — already named in the conference’s overall key-claim alongside FENRIR, Promp2Pwn, and XBOW as systems running autonomous bug-finding agents at production scale. The conference page should cross-link to this entity.