{
  "id": "AIBD-0237",
  "title": "curl merges about 50 bugfixes from Joshua Rogers' ZeroPath-assisted scans; maintainer calls the reports a new breed of analyzer output",
  "summary": "In Sept 2025 curl received hundreds of candidate issues found mainly with the ZeroPath AI analyzer by Joshua Rogers; maintainer Daniel Stenberg merged about 50 bugfixes from the first list.",
  "date_observed": "2025-10-10",
  "date_basis": "unassessed",
  "date_precision": "unassessed",
  "benefit_status": null,
  "source_collection": null,
  "source_entry": null,
  "account": "The reports arrived from mid-September 2025. Stenberg writes that a security report received on 16 September accurately identified a possible stack-based buffer overflow in curl's Kerberos FTP code. It was not turned into a CVE only because the code could not be reached. The project then removed krb5-ftp support. The reporter, Joshua Rogers, then forwarded a large list of further potential issues found mostly with ZeroPath, an AI-powered code analyzer. That produced over two hundred possible problems despite curl's existing compilers, static analyzers and fuzzing. From the initial list about 50 separately identifiable bugfixes were merged. Second and third lists of 47 and 158 items followed. Stenberg told The Register that about 50 bugfixes based on Rogers' reports had been merged. Rogers' retrospective states that about 98% of the curl bugs reported and fixed were discovered by ZeroPath. It puts the running total of fixed bugs around 150.",
  "category": "benefit created",
  "unexpected": false,
  "purpose": "AI-powered static analysis of source code to find vulnerabilities and bugs.",
  "system": "ZeroPath AI code analyzer (with other scanners tested by Rogers)",
  "model_version": null,
  "developer": "ZeroPath",
  "deployer": "Joshua Rogers (independent security researcher); fixes merged by the curl project",
  "location": null,
  "domain": "Cybersecurity / open-source software quality",
  "segment": "Technology",
  "benefit_type": "Reduced Risk",
  "taxonomy_note": "Bugfixes rather than confirmed vulnerabilities are read as risk reduced.",
  "registry_ids": {},
  "ratings": [
    {
      "group": "organizational",
      "depth": 2,
      "reason": "About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer."
    },
    {
      "group": "societal",
      "depth": 1,
      "reason": "curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes."
    }
  ],
  "ai_role": {
    "status": "assessed",
    "statement": "The maintainer confirms the reports' quality and the merged fixes. He notes he does not know the exact split between tool and human. Rogers attributes ~98% of the fixed curl bugs to ZeroPath. Both the deployer and the confirming maintainer are independent of the vendor."
  },
  "evidence": [
    {
      "kind": "report",
      "citation": "Daniel Stenberg, daniel.haxx.se, 10 Oct 2025",
      "title": "A new breed of analyzers",
      "url": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/",
      "date": "2025-10-10",
      "written_by": "beneficiary",
      "quote": "Out of that initial list, we merged about 50 separately identifiable bugfixes."
    },
    {
      "kind": "news report",
      "citation": "Thomas Claburn, The Register, 2 Oct 2025",
      "title": "Curl project, swamped with AI slop, finds not all AI is bad",
      "url": "https://www.theregister.com/software/2025/10/02/curl-project-swamped-with-ai-slop-finds-not-all-ai-is-bad/588432",
      "date": "2025-10-02",
      "written_by": "independent",
      "quote": "Stenberg told The Register that about 50 bugfixes based on Rogers' reports have been merged."
    },
    {
      "kind": "report",
      "citation": "Joshua Rogers, personal blog (retrospective), 2025",
      "title": "Retrospective: AI-powered security engineers and source code scanners",
      "url": "https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
      "date": null,
      "written_by": "deployer",
      "quote": "Approximately 98% of the bugs reported and fixed in the curl codebase were discovered by ZeroPath."
    }
  ],
  "replication": {
    "produced_by": [
      "A large, mature C codebase already covered by conventional analyzers and fuzzing",
      "An expert researcher filtering scanner output before reporting",
      "Maintainers willing to work through long candidate lists"
    ],
    "must_hold": [
      "Human triage to remove false positives",
      "Maintainer capacity to review hundreds of items"
    ],
    "echoes": [
      {
        "date": "2025-09-23",
        "setting": "Aisle's AI-powered pipeline (Stanislav Fort) reports a confirmed curl vulnerability",
        "model_version": null,
        "outcome": "recurred",
        "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/"
      }
    ]
  },
  "paired_incident": null,
  "headline": "curl merges about 50 bugfixes from ZeroPath-assisted scans",
  "metric": "about 50 separately identifiable bugfixes were merged",
  "comparator": {
    "against": "curl's existing compilers, static analyzers and fuzzers (scan-build, clang-tidy, CodeSonar, Coverity, CodeQL, OSS-Fuzz), whose findings were already all fixed",
    "before": "we always address and fix every warning and complaint they report",
    "after": "over two hundred new potential problems",
    "basis": "measured",
    "quote": "In the curl project we continuously run compilers with maximum pickiness enabled and we throw scan-build, clang-tidy, CodeSonar, Coverity, CodeQL and OSS-Fuzz at it and we always address and fix every warning and complaint they report so it was a little surprising that this tool now suddenly could produce over two hundred new potential problems.",
    "url": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/"
  },
  "later": {
    "status": "persisted",
    "date": "2025-10-19",
    "note": "Rogers' retrospective of 19 October 2025 put curl's count of fixed ZeroPath-detected bugs at around 150 and expected about 200 within a week.",
    "quote": "At the moment, the curl project has fixed around 150 of the bugs detected by ZeroPath, but I believe that by the end of next week, it will be around 200.",
    "url": "https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability"
  },
  "value": null,
  "developer_country": "United States",
  "deployer_country": null,
  "unrated_because": null,
  "brief_notes": null,
  "brief": null,
  "revisions": [
    {
      "date": "2026-10-20",
      "change": "Record drafted from the cited sources.",
      "source": null,
      "editor": "AIBD"
    },
    {
      "date": "2026-10-21",
      "change": "Added what the benefit is measured against, what happened since from the cited sources.",
      "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/; https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
      "editor": "AIBD"
    },
    {
      "date": "2026-10-21",
      "change": "Benefit type set to Reduced Risk under Trustible's full taxonomy of 23 types; it was Improved Knowledge Discovery among the six first used.",
      "source": "https://trustible.ai/post/a-framework-for-measuring-the-benefits-of-ai/",
      "editor": "AIBD"
    },
    {
      "date": "2026-10-21",
      "change": "Country of the developer added from the organization's own site or a registry.",
      "source": "https://zeropath.com/privacy",
      "editor": "AIBD"
    },
    {
      "date": "2026-10-21",
      "change": "Prose pass: a rating reason, account, the system's part rewritten in shorter sentences with abbreviations expanded; facts, figures and quotations unchanged.",
      "source": null,
      "editor": "AIBD"
    }
  ],
  "confidence": "reported",
  "shade": "medium",
  "claim_status": "Independently reported",
  "claim_basis": "Sources: one independent news report, the deployer's report and the beneficiary's report. The cited evidence includes no independent study or report and no finding by a regulator or court.",
  "profile": {
    "case_id": "AIBD-0237",
    "catalog_version": "1.0.0",
    "source_fingerprint": "0ab5f9fe26d8b28b6cc01d061326b1f7281c807d2f8b66f6ae744af8a0a80b2c",
    "collection_refs": [
      {
        "collection_id": "aibd",
        "version": "snapshot-8bf7cfec9cb185aa"
      },
      {
        "collection_id": "aibd",
        "version": "2026-10-25"
      },
      {
        "collection_id": "chanticleer",
        "version": "2026-10-25"
      }
    ],
    "source_ids": [
      "AIBD-0237-source-0001",
      "AIBD-0237-source-0002",
      "AIBD-0237-source-0003"
    ],
    "families": {
      "strategic assessments": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "record_ids": []
      },
      "evaluations": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "record_ids": []
      },
      "monetary observations": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "record_ids": []
      },
      "institutional decisions": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "record_ids": []
      }
    },
    "fields": {
      "actors[]": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "developer": "ZeroPath",
            "deployer": "Joshua Rogers (independent security researcher); fixes merged by the curl project"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "developer",
            "deployer"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "actors[].ownership_control": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "ai_contribution": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "ai_role": {
              "status": "assessed",
              "statement": "The maintainer confirms the reports' quality and the merged fixes. He notes he does not know the exact split between tool and human. Rogers attributes ~98% of the fixed curl bugs to ZeroPath. Both the deployer and the confirming maintainer are independent of the vendor."
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ai_role"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "ai_relationship": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "category": "benefit created",
            "ai_role": {
              "status": "assessed",
              "statement": "The maintainer confirms the reports' quality and the merged fixes. He notes he does not know the exact split between tool and human. Rogers attributes ~98% of the fixed curl bugs to ZeroPath. Both the deployer and the confirming maintainer are independent of the vendor."
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ai_role",
            "category"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "assessments[].alternatives": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "assessments[].assessor_date": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "assessments[].depth": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "ratings": [
              {
                "group": "organizational",
                "depth": 2,
                "reason": "About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer."
              },
              {
                "group": "societal",
                "depth": 1,
                "reason": "curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ratings"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "assessments[].display_confidence": {
        "state": "value_present",
        "value": {
          "kind": "structured",
          "data": {
            "confidence": "medium",
            "evidence_word": "reported",
            "claim_status": "Independently reported",
            "basis": "Sources: one independent news report, the deployer's report and the beneficiary's report. The cited evidence includes no independent study or report and no finding by a regulator or court.",
            "interpretation": "Existing display rule preserved; the richer outcome-specific confidence question still needs review."
          }
        },
        "provenance": {
          "kind": "curatorial",
          "basis": "Derived from the existing case display properties; not a new evidentiary judgment.",
          "record_fields": [],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "assessments[].rationale": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "ratings": [
              {
                "group": "organizational",
                "depth": 2,
                "reason": "About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer."
              },
              {
                "group": "societal",
                "depth": 1,
                "reason": "curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ratings"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "assessments[].rubric_version": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "assessments[].status_basis": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "assessments[].target": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "ratings": [
              {
                "group": "organizational",
                "depth": 2,
                "reason": "About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer."
              },
              {
                "group": "societal",
                "depth": 1,
                "reason": "curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ratings"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "availability": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "brief": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "case_kind": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "case_links[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "claims[].evidence_links": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "claims[].evidence_strength": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "claims[].missingness": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "claims[].proposition": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "cross_border_flows[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "decisions[].action_outcome": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "institutional decisions"
      },
      "decisions[].grounds": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "institutional decisions"
      },
      "decisions[].institution_task": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "institutional decisions"
      },
      "decisions[].success_criterion": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "institutional decisions"
      },
      "deployment_stage": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "economics[].amount": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].costs[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].counterfactual": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].currency_price_basis": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].gross_net": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].measure_type": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].period_unit": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].realization": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].recipient_payer": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].return_payback": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "economics[].valuation_method": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "monetary observations"
      },
      "evaluations[].ai_uplift": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].comparator": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].design": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].effect": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].exposure": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].id": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].measurement_method": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].metric": {
        "state": "not_assessed",
        "provenance": {
          "kind": "legacy_record",
          "basis": "Mapped from the existing case description without a new external source review.",
          "record_fields": [
            "metric"
          ],
          "source_refs": []
        },
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations",
        "display": {
          "answer": "about 50 separately identifiable bugfixes were merged",
          "editor_note": ""
        }
      },
      "evaluations[].reproduction_materials": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].setting_sample": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "evaluations[].uncertainty_limitations": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "evaluations"
      },
      "external_references[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "follow_up[]": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "later": {
              "status": "persisted",
              "date": "2025-10-19",
              "note": "Rogers' retrospective of 19 October 2025 put curl's count of fixed ZeroPath-detected bugs at around 150 and expected about 200 within a week.",
              "quote": "At the moment, the curl project has fixed around 150 of the bugs detected by ZeroPath, but I believe that by the end of next week, it will be around 200.",
              "url": "https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability"
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "later"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "human_oversight": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "id": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "id": "AIBD-0237"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "id"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "infrastructure_dependencies[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].beneficiaries": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].beneficiary_count": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].benefit_type": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "benefit_type": "Reduced Risk",
            "taxonomy_note": "Bugfixes rather than confirmed vulnerabilities are read as risk reduced."
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "benefit_type",
            "taxonomy_note"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "outcomes[].claim": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "account": "The reports arrived from mid-September 2025. Stenberg writes that a security report received on 16 September accurately identified a possible stack-based buffer overflow in curl's Kerberos FTP code. It was not turned into a CVE only because the code could not be reached. The project then removed krb5-ftp support. The reporter, Joshua Rogers, then forwarded a large list of further potential issues found mostly with ZeroPath, an AI-powered code analyzer. That produced over two hundred possible problems despite curl's existing compilers, static analyzers and fuzzing. From the initial list about 50 separately identifiable bugfixes were merged. Second and third lists of 47 and 158 items followed. Stenberg told The Register that about 50 bugfixes based on Rogers' reports had been merged. Rogers' retrospective states that about 98% of the curl bugs reported and fixed were discovered by ZeroPath. It puts the running total of fixed bugs around 150.",
            "benefit_type": "Reduced Risk"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "account",
            "benefit_type"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "outcomes[].distribution": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].duration": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].id": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].stakeholder_group": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "ratings": [
              {
                "group": "organizational",
                "depth": 2,
                "reason": "About 50 merged bugfixes from the first list, a potential overflow identified and unused code removed, per the curl maintainer."
              },
              {
                "group": "societal",
                "depth": 1,
                "reason": "curl is widely deployed, but no user-facing incident was averted. The merged fixes are described as mostly small mistakes."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "ratings"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "outcomes[].status": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].tradeoffs": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "outcomes[].unexpected": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "unexpected": false,
            "purpose": "AI-powered static analysis of source code to find vulnerabilities and bugs."
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "unexpected",
            "purpose"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "places[]": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "developer_country": "United States"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "developer_country"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "purpose": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "purpose": "AI-powered static analysis of source code to find vulnerabilities and bugs."
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "purpose"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "record_dates": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "date_observed": "2025-10-10",
            "revisions": [
              {
                "date": "2026-10-20",
                "change": "Record drafted from the cited sources.",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Added what the benefit is measured against, what happened since from the cited sources.",
                "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/; https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Benefit type set to Reduced Risk under Trustible's full taxonomy of 23 types; it was Improved Knowledge Discovery among the six first used.",
                "source": "https://trustible.ai/post/a-framework-for-measuring-the-benefits-of-ai/",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Country of the developer added from the organization's own site or a registry.",
                "source": "https://zeropath.com/privacy",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Prose pass: a rating reason, account, the system's part rewritten in shorter sentences with abbreviations expanded; facts, figures and quotations unchanged.",
                "editor": "AIBD"
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "date_observed",
            "revisions"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "replication.attempts[]": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "replication": {
              "produced_by": [
                "A large, mature C codebase already covered by conventional analyzers and fuzzing",
                "An expert researcher filtering scanner output before reporting",
                "Maintainers willing to work through long candidate lists"
              ],
              "must_hold": [
                "Human triage to remove false positives",
                "Maintainer capacity to review hundreds of items"
              ],
              "echoes": [
                {
                  "date": "2025-09-23",
                  "setting": "Aisle's AI-powered pipeline (Stanislav Fort) reports a confirmed curl vulnerability",
                  "outcome": "recurred",
                  "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/"
                }
              ]
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "replication"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "replication.conditions": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "replication": {
              "produced_by": [
                "A large, mature C codebase already covered by conventional analyzers and fuzzing",
                "An expert researcher filtering scanner output before reporting",
                "Maintainers willing to work through long candidate lists"
              ],
              "must_hold": [
                "Human triage to remove false positives",
                "Maintainer capacity to review hundreds of items"
              ],
              "echoes": [
                {
                  "date": "2025-09-23",
                  "setting": "Aisle's AI-powered pipeline (Stanislav Fort) reports a confirmed curl vulnerability",
                  "outcome": "recurred",
                  "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/"
                }
              ]
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "replication"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "revision_history[]": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "revisions": [
              {
                "date": "2026-10-20",
                "change": "Record drafted from the cited sources.",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Added what the benefit is measured against, what happened since from the cited sources.",
                "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/; https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Benefit type set to Reduced Risk under Trustible's full taxonomy of 23 types; it was Improved Knowledge Discovery among the six first used.",
                "source": "https://trustible.ai/post/a-framework-for-measuring-the-benefits-of-ai/",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Country of the developer added from the organization's own site or a registry.",
                "source": "https://zeropath.com/privacy",
                "editor": "AIBD"
              },
              {
                "date": "2026-10-21",
                "change": "Prose pass: a rating reason, account, the system's part rewritten in shorter sentences with abbreviations expanded; facts, figures and quotations unchanged.",
                "editor": "AIBD"
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "revisions"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "sector": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "domain": "Cybersecurity / open-source software quality",
            "segment": "Technology"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "domain",
            "segment"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "sources[].access_version": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "sources[].citation_locator": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "evidence": [
              {
                "kind": "report",
                "citation": "Daniel Stenberg, daniel.haxx.se, 10 Oct 2025",
                "title": "A new breed of analyzers",
                "url": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/",
                "date": "2025-10-10",
                "written_by": "beneficiary",
                "quote": "Out of that initial list, we merged about 50 separately identifiable bugfixes."
              },
              {
                "kind": "news report",
                "citation": "Thomas Claburn, The Register, 2 Oct 2025",
                "title": "Curl project, swamped with AI slop, finds not all AI is bad",
                "url": "https://www.theregister.com/software/2025/10/02/curl-project-swamped-with-ai-slop-finds-not-all-ai-is-bad/588432",
                "date": "2025-10-02",
                "written_by": "independent",
                "quote": "Stenberg told The Register that about 50 bugfixes based on Rogers' reports have been merged."
              },
              {
                "kind": "report",
                "citation": "Joshua Rogers, personal blog (retrospective), 2025",
                "title": "Retrospective: AI-powered security engineers and source code scanners",
                "url": "https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
                "written_by": "deployer",
                "quote": "Approximately 98% of the bugs reported and fixed in the curl codebase were discovered by ZeroPath."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "evidence"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "sources[].id": {
        "state": "value_present",
        "value": {
          "kind": "identifiers",
          "identifiers": [
            "AIBD-0237-source-0001",
            "AIBD-0237-source-0002",
            "AIBD-0237-source-0003"
          ],
          "role": "Existing evidence items, in their original order"
        },
        "provenance": {
          "kind": "curatorial",
          "basis": "Stable within the fingerprinted record version; no source content or source review has been added.",
          "record_fields": [],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "complete"
      },
      "sources[].language": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "sources[].relationship": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "evidence": [
              {
                "kind": "report",
                "citation": "Daniel Stenberg, daniel.haxx.se, 10 Oct 2025",
                "title": "A new breed of analyzers",
                "url": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/",
                "date": "2025-10-10",
                "written_by": "beneficiary",
                "quote": "Out of that initial list, we merged about 50 separately identifiable bugfixes."
              },
              {
                "kind": "news report",
                "citation": "Thomas Claburn, The Register, 2 Oct 2025",
                "title": "Curl project, swamped with AI slop, finds not all AI is bad",
                "url": "https://www.theregister.com/software/2025/10/02/curl-project-swamped-with-ai-slop-finds-not-all-ai-is-bad/588432",
                "date": "2025-10-02",
                "written_by": "independent",
                "quote": "Stenberg told The Register that about 50 bugfixes based on Rogers' reports have been merged."
              },
              {
                "kind": "report",
                "citation": "Joshua Rogers, personal blog (retrospective), 2025",
                "title": "Retrospective: AI-powered security engineers and source code scanners",
                "url": "https://joshua.hu/retrospective-zeropath-ai-sast-source-code-security-scanners-vulnerability",
                "written_by": "deployer",
                "quote": "Approximately 98% of the bugs reported and fixed in the curl codebase were discovered by ZeroPath."
              }
            ]
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "evidence"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "sources[].upstream_sources": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "strategic_assessments[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial",
        "family": "strategic assessments"
      },
      "summary": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "summary": "In Sept 2025 curl received hundreds of candidate issues found mainly with the ZeroPath AI analyzer by Joshua Rogers; maintainer Daniel Stenberg merged about 50 bugfixes from the first list.",
            "account": "The reports arrived from mid-September 2025. Stenberg writes that a security report received on 16 September accurately identified a possible stack-based buffer overflow in curl's Kerberos FTP code. It was not turned into a CVE only because the code could not be reached. The project then removed krb5-ftp support. The reporter, Joshua Rogers, then forwarded a large list of further potential issues found mostly with ZeroPath, an AI-powered code analyzer. That produced over two hundred possible problems despite curl's existing compilers, static analyzers and fuzzing. From the initial list about 50 separately identifiable bugfixes were merged. Second and third lists of 47 and 158 items followed. Stenberg told The Register that about 50 bugfixes based on Rogers' reports had been merged. Rogers' retrospective states that about 98% of the curl bugs reported and fixed were discovered by ZeroPath. It puts the running total of fixed bugs around 150."
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "summary",
            "account"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "systems[].autonomy_permissions": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].component_role": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].deployment_configuration": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].inputs_outputs": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].model_name": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].model_version": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "systems[].product_name": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "system": "ZeroPath AI code analyzer (with other scanners tested by Rogers)"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "system"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "systems[].provider": {
        "state": "value_present",
        "value": {
          "kind": "structured",
          "data": {
            "application_developer": "ZeroPath"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Mapped from the existing case description without a new external source review.",
          "record_fields": [
            "developer"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "taxonomy_crosswalks[]": {
        "state": "not_assessed",
        "review_state": "not_assessed",
        "coverage": "partial"
      },
      "title": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "title": "curl merges about 50 bugfixes from Joshua Rogers' ZeroPath-assisted scans; maintainer calls the reports a new breed of analyzer output",
            "headline": "curl merges about 50 bugfixes from ZeroPath-assisted scans"
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "title",
            "headline"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      },
      "version": {
        "state": "value_present",
        "value": {
          "kind": "identifiers",
          "identifiers": [
            "0ab5f9fe26d8b28b6cc01d061326b1f7281c807d2f8b66f6ae744af8a0a80b2c"
          ],
          "role": "SHA-256 of normalized original case data"
        },
        "provenance": {
          "kind": "curatorial",
          "basis": "Deterministic content version assigned by the local migration.",
          "record_fields": [],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "complete"
      },
      "workflow": {
        "state": "value_present",
        "value": {
          "kind": "record_fields",
          "fields": {
            "account": "The reports arrived from mid-September 2025. Stenberg writes that a security report received on 16 September accurately identified a possible stack-based buffer overflow in curl's Kerberos FTP code. It was not turned into a CVE only because the code could not be reached. The project then removed krb5-ftp support. The reporter, Joshua Rogers, then forwarded a large list of further potential issues found mostly with ZeroPath, an AI-powered code analyzer. That produced over two hundred possible problems despite curl's existing compilers, static analyzers and fuzzing. From the initial list about 50 separately identifiable bugfixes were merged. Second and third lists of 47 and 158 items followed. Stenberg told The Register that about 50 bugfixes based on Rogers' reports had been merged. Rogers' retrospective states that about 98% of the curl bugs reported and fixed were discovered by ZeroPath. It puts the running total of fixed bugs around 150.",
            "replication": {
              "produced_by": [
                "A large, mature C codebase already covered by conventional analyzers and fuzzing",
                "An expert researcher filtering scanner output before reporting",
                "Maintainers willing to work through long candidate lists"
              ],
              "must_hold": [
                "Human triage to remove false positives",
                "Maintainer capacity to review hundreds of items"
              ],
              "echoes": [
                {
                  "date": "2025-09-23",
                  "setting": "Aisle's AI-powered pipeline (Stanislav Fort) reports a confirmed curl vulnerability",
                  "outcome": "recurred",
                  "source": "https://daniel.haxx.se/blog/2025/10/10/a-new-breed-of-analyzers/"
                }
              ]
            }
          }
        },
        "provenance": {
          "kind": "legacy_record",
          "basis": "Preserved from the existing AIBD record; external sources were not rechecked.",
          "record_fields": [
            "account",
            "replication"
          ],
          "source_refs": []
        },
        "review_state": "record_mapped",
        "coverage": "partial"
      }
    },
    "summary": {
      "total": 91,
      "addressed": 91,
      "known": 29,
      "reviewed": 0,
      "record_mapped": 29,
      "not_assessed": 62,
      "complete": false,
      "by_state": {
        "value_present": 29,
        "not_reported": 0,
        "unresolved": 0,
        "not_assessed": 62,
        "not_applicable": 0,
        "withheld": 0,
        "source_unavailable": 0
      }
    }
  }
}