AI Pulse · Frontier Labs Watch

A security firm called Aisle found six CVEs in curl after AI-driven security tools from both OpenAI and Anthropic had scanned the same codebase and reported no issues. That is a clean, uncomfortable test case. These tools were not asked to solve an abstract benchmark. They looked at a widely used piece of real software and missed vulnerabilities that were later identified.

For a business owner, the takeaway is not that AI security tools are useless. It is that a clean AI report is not proof your software is safe. If your team uses AI to review code, triage vulnerabilities, or approve patches, it needs a second layer of checking. That could mean human review for high-risk changes, separate testing tools, or clear rules about what an AI scan can and cannot sign off on.

The timing also matters. Google made patch-quality claims for its Cyber model in the same week. AI labs are getting better at security work, but performance claims should be judged against independent findings in real codebases, not just vendor evaluations. This is the kind of thing we build into an AI command centre, tracking where AI is producing useful work and where a human control still needs to sit.