Security firm finds six curl CVEs after OpenAI and Anthropic missed them

·1 views

A security company called Aisle discovered six vulnerabilities in curl, the widely used data transfer tool, and reported them as CVEs. The findings came after AI-powered security tools from OpenAI and Anthropic reportedly returned zero results when scanning the same codebase. Aisle documented the discovery process in a blog post, highlighting the limitations of current AI systems in identifying real-world security flaws. The findings raise questions about the reliability of AI-assisted vulnerability research compared to traditional human-led security audits.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ThoughtDAG's Session Atlas Turns Local AI Agent Logs into Editable Graph Mirrors

ThoughtDAG has launched Session Atlas, a desktop feature that imports local AI agent sessions from tools like Codex and Claude Code into editable graph-based mirrors grouped by project. Unlike conventional agent memory systems, Atlas maintains a strict separation between the original session record, the user's curated workspace, and the context sent to future model requests. The original session file is never modified; users can edit, reorganize, or annotate mirrored nodes independently without altering the source history. Atlas also monitors active local sessions and incrementally appends new turns, respecting user edits and avoiding overwrites. The tool aims to give users explicit, transparent control over what context their AI agents receive, rather than relying on automatic or hidden memory retrieval.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds automated LinkedIn creator research pipeline for under $1 using Apify MCP

A developer has built an end-to-end LinkedIn creator research workflow using the Apify Model Context Protocol (MCP) server integrated with Claude Code. The pipeline chains three tools — a LinkedIn posts scraper, a comments scraper, and a website content crawler — allowing an AI agent to discover and run each tool within a single session. In under 18 minutes and for approximately $0.69, the workflow produced a content playbook, an ideal customer profile derived from comment analysis, and a CSV of highly engaged commenters. The Apify MCP server exposes Actors as callable tools via a configurable URL, eliminating the need for manual data transfers between tabs or applications. The author notes the same prompt can be redirected at any public LinkedIn profile, including competitors or one's own account.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Hosted Chatwoot Handles 348K Messages on 1.8 GB RAM, One VPS

A developer running self-hosted Chatwoot for eight clients measured real-world resource usage, finding that 348,703 messages across 20 inboxes consumed just 1.8 GB of RAM on a single VPS. The entire setup — covering Rails, Postgres, Sidekiq, and Redis containers — ran comfortably on a 4 GB virtual server alongside other workloads. Unlike seat-based cloud pricing, self-hosted resource consumption scales with message volume rather than the number of agents, making it economically attractive for larger teams. However, the author cautions that cloud tiers impose conversation history retention caps — as short as 30 days on the free tier — which can be a more consequential constraint than the monthly price. Self-hosting is described as genuinely viable for teams with operational capacity, but cloud hosting is recommended for those without staff comfortable managing server issues outside business hours.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Zero-Dependency C++17 Security Scanner RepoShield for CI Pipelines

A developer has built RepoShield, a standalone C++17 command-line tool designed to analyze repository security without relying on third-party runtime libraries. The tool performs filesystem traversal, code structure extraction, dependency analysis, risk scoring, and policy enforcement within a single unified pipeline. RepoShield goes beyond flagging individual vulnerabilities by generating machine-readable reports and returning exit codes that can automatically fail CI pipelines when security policies are violated. Built under a strict zero-dependency constraint, the project uses only C++17 standard library features to handle tasks typically delegated to external packages. The tool was developed with the goal of answering practical security questions about a repository, including what risks exist, where they are located, how serious they are, and what remediation steps should follow.

0 comments Read more at DEV Community