Just the rumour of a bug is enough to find an exploit these days

The author, an OCaml maintainer, describes a startling new reality in software security: the mere rumor of a vulnerability is now sufficient for AI agents to independently discover and exploit the flaw. This observation stems from a recent experience where probes for a newly identified path traversal bug appeared on their web server minutes after a fix was publicly proposed. This rapid exploitation, often preceding patch availability, is driven by the increasing sophistication of AI models capable of identifying and exploiting vulnerabilities from minimal information.

• AI agents like Claude Fable and DeepSeek V4 Pro can identify vulnerabilities and generate exploits with remarkable speed, sometimes in less than a minute.
• Traditional security embargoes, which rely on secrecy to protect users, are no longer effective as AI-powered automated watchers can quickly deduce and exploit flaws from public code changes or vague descriptions.
• The "mean time to exploit" has turned negative, meaning exploitation can occur before a patch is released, indicating a critical shift in the security landscape.
• This creates an untenable situation for open-source maintainers, who face an overwhelming surge of machine-generated security reports and a significant "bugonomics" imbalance where exploit generation outpaces remediation capacity.
• The author proposes several potential adaptations: developing fixes in truly private environments (though current tools like GitHub's private forks have limitations), abandoning embargoes in favor of continuous, rapid public patching, and implementing proactive, protocol-level protections that can dynamically mitigate threats.
• Access to advanced frontier AI models, like Anthropic's Project Glasswing, remains a significant hurdle for smaller open-source projects, further exacerbating the resource imbalance.
• The author also suggests future research into "antibotty defensive testbeds" and compiling Lean specifications into enforcement automata for proactive defense.

The rapid advancement of AI-driven exploit generation necessitates a fundamental re-evaluation of established security practices, urging open-source communities to prioritize continuous delivery, robust tooling, and collaborative, dynamic defense mechanisms to cope with this unprecedented challenge.