Just a rumour of a bug is enough to find a security exploit these days
Simon Willison’s Weblog Simon Willison
A Cambridge professor says bug talk is now drawing exploit probes in minutes. That’s bad news for open-source patching and old-school embargoes.
Based on reporting by Simon Willison’s Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
A Cambridge computer science professor is warning that the gap between “we found a bug” and “someone is already poking at it” may have collapsed to almost nothing. Anil Madhavapeddy, who also helps maintain the OCaml compiler, says security issues in OCaml projects are now attracting attempted exploits within minutes of patches being shared for discussion.
He describes a case where, about ten minutes after a patch discussion went public, the project’s site started seeing probes for percent-encoded traversal sequences. That suggests automated watchers are scanning public repositories and reacting fast, not waiting for a release note or a CVE.
Madhavapeddy says modern coding agents are part of the problem because they can turn a tiny hint into a working exploit. He says he has been able to demonstrate that with his own agents, and when Claude Fable refused the task he switched to DeepSeek V4 Pro.
His point is blunt: the old practice of quietly handling new issues before disclosure may not fit this pace anymore. If a bug hint can become an exploit in minutes, then the community needs new ways to keep fixes safe while they’re still being discussed.
The pressure isn’t limited to OCaml. rclone maintainer Nick Craig-Wood says the project saw about 20 GitHub security disclosures in its first 10 years, then more than 40 in the last month alone. He says AI tools help triage the flood, but GitHub’s CVE assignments have slowed to 3-4 weeks, forcing point releases to ship with CVE-PENDING in the changelog.
My take — AI-written commentary, not fact-checked reporting
This is what happens when disclosure meets automation and loses. Open source has spent years pretending a patch can sit in public without attracting sharks, and now the sharks have code review skills. The fix is not more ceremony; it’s faster, tighter, and probably less naive handling of sensitive bugs.
Read more about this at: Simon Willison’s Weblog