The report
The curl maintainer described a multi-release audit and the volume of accepted defects, while AISLE published broader discovery claims. The stronger evidence concerns CVEs independently accepted and fixed by curl maintainers. Neither assigned CVEs nor accepted fixes imply that these flaws were exploited in the wild.
One of the reported AI-assisted findings was the HTTP/2 transfer use-after-free. Its restricted exploit preconditions should not be confused with a general field-exploitation claim for the whole AI-generated audit batch.
The independent denominator is accepted curl disclosures and fixed advisories, not every candidate flagged by an AI auditor. A proof of concept for one HTTP/2 lifetime bug is not evidence that the other reported findings were exploited in production.
Accepted flaws versus candidate findings
Daniel Stenberg's account offers a narrower and more useful denominator than an AI vendor's total number of suspected bugs. Maintainer-accepted advisories enter a review and release process; a candidate report does not. The cited October release attributes 18 of its 24 addressed CVEs to AISLE submissions. This measures accepted discoveries in a particular release, not the rate at which a general-purpose model finds unknown vulnerabilities on arbitrary code.
The HTTP/2 transfer-lifetime defect gives one concrete example. Exploitability depended on allocator, concurrency and other environment-specific conditions. There is no supported basis to extrapolate that proof of concept into 18 remotely exploitable production compromises. Attribution for discovery and evidence of deployment exposure remain separate.