Safety#Security scan#AI safety
Exploit probes now arrive minutes after a fix PR: AI is breaking open-source disclosure
An OCaml maintainer says exploit probes matched his cohttp fix PR within 10 minutes; AI agents now turn bug rumours into working exploits in minutes.
On August 22, Anil Madhavapeddy — an OCaml core maintainer and professor of computer science at Cambridge — reported on his blog that about ten minutes after he opened the pull request fixing a path-traversal flaw in the HTTP library cohttp (tracked as OSEC-2026-16), his own server’s logs filled with probes trying exactly the percent-encoded traversal sequences the bug allowed. Automated watchers, he concluded, sit on public repos waiting for hint streams. What has security people questioning coordinated disclosure is the second half of his record: by his own account, his agent, running on DeepSeek V4 Pro, produced a working exploit against a local test server in under a minute. An InfoQ analysis on October 3 (Chinese edition October 13) pulled the August incident back into view.
Key points
- On August 22, about ten minutes after the cohttp 6.3.0 fix PR (mirage/ocaml-cohttp#1145) went public, the maintainer’s server logs showed probes walking through percent-encoded traversal sequences that matched the flaw exactly.
- In the same session, Claude Fable refused on security grounds to help analyze the path normalization; DeepSeek V4 Pro complied, and the agent built a usable exploit in under a minute.
- Research the note cites: an arXiv paper submitted in April 2024 measured GPT-4 exploiting 87% of 15 one-day vulnerabilities when given CVE descriptions, and 7% without them.
Background
The traditional disclosure script, as Madhavapeddy described it to InfoQ, is to fix privately, notify affected users, then publish an advisory — the embargo gives patches time to spread. That assumption is now squeezed from both ends. On the research side, arXiv:2404.08144 (Daniel Kang’s group at UIUC, submitted April 2024) connected the dots early: across 15 one-day vulnerabilities, GPT-4 with a CVE description exploited 87%, without it only 7%, while GPT-3.5 and open-source scanners like ZAP and Metasploit scored zero — the model could both read the advisory and write the exploit. On the engineering side, the pressure is already visible. We covered Google suspending its open-source bug bounty on October 4 because automated submissions flooded the process, and Zimbra’s CVE-2026-73570, where a patch shipped three weeks before disclosure and 274 servers were breached in the gap. The timeline here: the first-hand note on August 22, commentary in tl;dr sec #345 on September 10, the InfoQ analysis in English on October 3 and in Chinese on October 13.
What happened
The note documents the full chain first-hand. Sapphire Livingstone found the flaw and co-developed the fix; the report arrived through Jane Street on Slack, and it too had initially been found by Claude Fable. The fix itself was unglamorous — normalize percent-encoded path separators in the request URL. Madhavapeddy opened the PR publicly, intending to get more eyes on it; within about ten minutes his site began fielding probes for percent-encoded traversal sequences. He then pointed Claude at the code and asked whether the path normalization was sound — Claude Fable declined on security grounds. DeepSeek V4 Pro answered the same question, independently surfaced several related issues, and his agent had an exploit probing a local live server in under a minute. The exploitation timeline he assembled:
| Hint made public | Exploitation seen | Source |
|---|---|---|
| cohttp fix PR (2026-08-22) | Matching probes ~10 minutes later | Madhavapeddy’s note |
| marimo advisory, CVE-2026-39987 | About 9 hours | Madhavapeddy’s note |
| Langflow advisory, CVE-2026-33017 | 20 hours | Madhavapeddy’s note |
| Industry mean time to exploit | ~63 days in 2018–19; crossed zero in 2024, now about −7 days | Cited in the note |
Three partial fixes
Half the note is a sober audit of three ways out, each with its limits. Developing patches in GitHub temporary private forks cuts CI and integrations, allows only a single merged PR, and requires every reviewer to enroll as an admin — and Madhavapeddy argues it plugs the wrong leak, because descriptive information escaping matters more than the patch text itself. Shipping continuously with no embargoes works for projects shaped like the Linux kernel, which defers at most 7 days (14 exceptionally), or Chrome’s twice-weekly releases; the limit is downstream, where open-source packaging and redistribution chains cannot keep that pace. The third option is protocol-level virtual patching, where the server side holds the line first — Cloudflare’s managed rules for Log4shell in 2021 are the template — but open source has no distribution mechanism for such rules outside a commercial CDN.
What others say
Security researcher Clint Gibler, writing in tl;dr sec #345 on September 10, called the incident stark: “Within 10 minutes is insane.” His chain of reasoning: vulnerabilities are found faster, patching and patch adoption stay human-bound, and turning a hint into an exploit keeps getting easier — added up, the exploit window has gone negative, and he expects this to be a defining security question “over the next few months.” Per InfoQ, Adrian Mouat of Chainguard says the situation puts maintainers in an impossible position: attackers can deploy exploits even before an updated release exists, leaving users no recourse; he speculates projects may be forced to publish builds before source, which would break the fundamentals of open source. The same report quotes rclone creator Nick Craig-Wood: about 20 security disclosures in the project’s first decade, more than 40 in the last month alone, and notes QEMU has already shortened its embargo periods. Those two data points currently appear only in the InfoQ piece.
Our take
For maintainers, the working assumption has to change: a PR diff is public information the moment it is pushed, and so are repair descriptions, branch names and stray comments in issues — coordinated disclosure needs redesigning around the assumption that a hint is weaponized within minutes. For teams consuming open source, waiting out the disclosure cycle no longer works; what you can compress is your own upgrade latency and boundary defenses. The honest catch: the core evidence is still one anecdote — the note does not conclude whether the ten-minute probes were targeted or a coincidental scheduled scan, and whoever ran them is unidentified. The 87% figure comes from a small 2024 study built on GPT-4 and should not be extrapolated to today’s models. Defense is earlier-stage still: the note closes with two MPhil project ideas (an anti-bot defensive testbed, compiling Lean specifications into runtime enforcement automata), which tells you the engineering answers have not shipped. And the maintainer-versus-AI tension extends past disclosure — QGIS simply banned AI contributions outright this month, as we reported earlier.