Just the rumour of a bug is enough to find an exploit these days
Points and comments are a snapshot, not live.
AI agents can craft exploits from just a rumor of a bug.
The author fixed a path traversal bug in OCaml's cohttp library (6.3.0). Probes with the exact bug pattern appeared in webserver logs minutes after the public PR opened. The author's own AI agent independently found related issues and created a local exploit in under a minute. Mean time to exploit now precedes patches by 7 days. The author argues traditional embargoes fail because AI agents need only a general direction. Suggested remedies include private patch development, continuous shipping, and protocol-layer virtual patching. The author notes open-source maintainers lack access to frontier AI models due to security restrictions.
What commenters are saying
An rclone maintainer reports receiving over 40 security disclosures in the last month versus about 20 in the entire first decade, with a 75% hit rate. GitHub CVE assignment has slowed to 3-4 weeks from 2-3 days. Commenters note exploit development from commit messages is not new, but LLMs have automated and scaled the process. Some argue the bottleneck is not AI but organizational will: "Software will never be good if there's no will to make good software." One suggests blending security fixes into regular PRs to avoid management overhead.
Commenters also express gratitude for rclone, calling it essential for Linux/Google Drive use.