curl merges about 50 bugfixes from ZeroPath-assisted scans

AI system

System: ZeroPath AI code analyzer (with other scanners tested by Rogers)
Model: Not assessed
Release: Not assessed
Application developer: ZeroPath
Role: Not assessed
Configuration: Not assessed
Inputs and outputs: Not assessed
Autonomy: Not assessed
Workflow: A large, mature C codebase already covered by conventional analyzers and fuzzing. An expert researcher filtering scanner output before reporting. Maintainers willing to work through long candidate lists.
Human oversight: Not assessed
Relation to AI: The maintainer confirms the reports' quality and the merged fixes. He notes he does not know the exact split between tool and human. Rogers attributes ~98% of the fixed curl bugs to ZeroPath. Both the deployer and the confirming maintainer are independent of the vendor.
AI contribution: The maintainer confirms the reports' quality and the merged fixes. He notes he does not know the exact split between tool and human. Rogers attributes ~98% of the fixed curl bugs to ZeroPath. Both the deployer and the confirming maintainer are independent of the vendor.

Studies: Not assessed
Study design: Not assessed
Measurement: Not assessed
Setting and sample: Not assessed
Measures: about 50 separately identifiable bugfixes were merged
Comparison: curl's existing compilers, static analyzers and fuzzers (scan-build, clang-tidy, CodeSonar, Coverity, CodeQL, OSS-Fuzz), whose findings were already all fixed
Results: Reference: we always address and fix every warning and complaint they report. Result: over two hundred new potential problems.
Additional value from AI: Not assessed
Limitations: Not assessed
Denominators: Not assessed
Materials for replication: Not assessed

Participants: Developer: ZeroPath. Operator: Joshua Rogers (independent security researcher); fixes merged by the curl project.
Jurisdictions: Developer: United States.
Ownership and control: Not assessed
Dependencies: Not assessed
Cross-border connections: Not assessed
Geopolitical implications: Not assessed

Conditions for replication: Human triage to remove false positives. Maintainer capacity to review hundreds of items.
Replication attempts: 1 follow-up entries. Benefit recurred: 1.
Later findings: 19 October 2025. Rogers' retrospective of 19 October 2025 put curl's count of fixed ZeroPath-detected bugs at around 150 and expected about 200 within a week.
Availability: Not assessed
Institutional decision: Not assessed
Grounds: Not assessed
Action and result: Not assessed
Success criterion: Not assessed

Assessed benefits: Organizations. Society.
Depth: Organizations: 2. Society: 1.
Reasons: Organizations: About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer. Society: curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes.
Observed or intended: Not assessed
Rubric: Not assessed
Assessor and date: Not assessed
Alternative assessments: Not assessed
Fill: Independently reported

Kind: Not assessed
Related entries: Not assessed
Field: Cybersecurity / open-source software quality. Technology.
Purpose: AI-powered static analysis of source code to find vulnerabilities and bugs.
Dates: Date basis unassessed: 2025 (precision unassessed). Updated: 21 October 2026.
Stage: Not assessed
Version: SHA-256: 0ab5f9fe26d8…