AI Agents Turn Bug Rumours Into Exploits

• •Automated probes targeting an OCaml path traversal vulnerability began hitting a live server within ten minutes of a repair pull request being opened on GitHub, before any public
• •The mean time to exploit has reached negative seven days in 2026, meaning exploitation now routinely precedes the public patch, up from a 63-day lag recorded in 2018–19.
• •A 2026 academic paper argues that AI models are generating exploits faster than open-source maintainers can validate and ship fixes, with unequal access to frontier security tools

An OCaml library maintainer has described how automated probes targeting a freshly disclosed path traversal vulnerability began hitting a live web server within ten minutes of a repair pull request being quietly opened on GitHub — before any public advisory had been issued. The episode illustrates what security researchers are calling a fundamental collapse in the window between a vulnerability's existence becoming known and working exploit code being deployed against real infrastructure.

From private report to active probing in under ten minutes

The vulnerability, a path traversal flaw in the cohttp 6.3.0 HTTP library for OCaml, was originally reported privately via Jane Street on a Slack channel, where it had been discovered using the AI coding agent Claude Fable. The maintainer attempted to use his own AI agent to audit the affected code further. Fable declined outright, citing security restrictions tied to the absence of Project Glasswing access. A second model, DeepSeek V4 Pro, cooperated and independently surfaced several related issues. The maintainer then used an agent to construct a working local exploit in under a minute.

When the fix was opened as a public pull request — cohttp#1145 — to gather additional reviewer eyes, automated probes for percent-encoded path traversal sequences began reaching the maintainer's live server approximately ten minutes later. The maintainer notes that given the speed at which he personally assembled an exploit, a ten-minute automated attack window is itself surprisingly slow; a determined attacker monitoring public repositories could, in his assessment, be exploiting a newly visible issue within seconds.

Security embargoes: a model built for a slower era

Traditional co-ordinated vulnerability disclosure depends on keeping bug details secret until a patch is available and users have had time to update. That model assumes secrecy is achievable and that it materially reduces exposure. Both assumptions appear increasingly fragile. Research cited in the article found that when given only a CVE description, a GPT-4-based agent successfully exploited 87 per cent of a 15-vulnerability benchmark; without that description the figure fell to just 7 per cent. The implication is that any broad directional hint — a mailing list query, an unusual commit in an orphan branch, a context leak — may now constitute sufficient signal for an autonomous agent to begin hunting.

The mean time to exploit, which stood at roughly 63 days in 2018–19, crossed zero in 2024 and now sits at negative seven days, meaning exploitation routinely precedes the public patch. Recent cases support the trajectory: marimo's CVE-2026-39987 attracted its first exploitation attempt nine hours after an advisory was published, with no proof-of-concept code publicly available; Langflow's CVE-2026-33017 took twenty hours. As AI-assisted exploit discovery accelerates across ecosystems, the gap between disclosure and attack is not merely shrinking but inverting.

Bugonomics and the maintainer capacity problem

A May 2026 academic paper by Pesoli et al., titled Demystifying the Mythos or Disrupting Bugonomics?, introduces the term "bugonomics" to describe the economics of vulnerability discovery and remediation. Its central argument is that the constraint in the security pipeline has shifted: large language models are generating exploits at scale, but the human capacity to validate, triage, prioritise, and ship durable fixes has not expanded to match. Maintainer throughput — not attack capability — is now the bottleneck.

The maintainer argues this asymmetry is sharpened by unequal access to frontier AI tools. Project Glasswing, Anthropic's restricted programme for organisations with access to its most capable security-relevant models, has expanded to 150 organisations across 15 countries, including critical infrastructure operators, cloud providers, financial institutions, and the Linux Foundation. Independent open-source maintainers fall outside that perimeter. The maintainer, who describes himself as ambivalent about this in April, now characterises the exclusion as "pretty terribly" consequential. As AI capability spreads unevenly across development communities, the gap between well-resourced defenders and under-resourced maintainers widens.

Three remediation directions — and their limits

The maintainer outlines three broad responses. The first is stricter private patch development, though he notes that GitHub's temporary private fork mechanism severs CI integration and imposes workflow constraints that make it poorly suited to multi-repository issues common in open-source projects. More fundamentally, he argues, keeping the patch secret matters far less than ensuring the vulnerability description reaches only trustworthy parties — a problem that current open-source communication infrastructure, spread across Matrix, Discord, and Slack, is poorly equipped to solve.

The second approach is continuous public shipping: fixing issues openly, automating release pipelines, and reducing the embargo window to near zero on the logic that attackers already have the information anyway. Chrome ships two security releases per week and performs dynamic binary patching; the Linux kernel defers fixes by at most seven days. The obstacle for libraries like cohttp is packaging: unlike a single browser binary, OSS libraries are embedded in a diverse range of downstream products over which maintainers have no deployment control.

The third direction is protocol-layer virtual patching — deploying mitigations directly at network endpoints before a full fix is available. The cohttp path traversal bug, for instance, could have been mitigated immediately by normalising percent-encoded path separators in request URLs, a rule deployable the moment the report arrived. Cloudflare's rapid deployment of managed rules to blunt the Log4shell vulnerability in 2021 is cited as a precedent. The gap, the maintainer argues, is that open source lacks a comparable distribution mechanism outside commercial CDN infrastructure.

The window is closing for conventional disclosure

The cohttp episode was resolved collaboratively: Sapphire Livingstone found and reported the vulnerability, guided the fix, and co-developed the remediation; Michael Dales, Török Edwin, and Patrick Ferris reviewed the patch; Hannes Mehnert coordinated the advisory; and Thomas Gazagnaire contributed thinking on the broader triage problem. That kind of distributed human expertise remains essential. The deeper question the maintainer poses is whether open-source security processes — designed for a world where secrecy bought time — can be reconstituted quickly enough for a world where the rumour of a bug is all an autonomous agent needs to get started.

More in Artificial Intelligence

→

Artificial Intelligence GLM-5.3 Open-Weight Flags Cyber Risk Artificial Intelligence Racter: AI Prose Generator From 1984 Artificial Intelligence AI Agents Claim Five Maths Firsts Artificial Intelligence Conduct: Open-Source AI Agent Guardrails Artificial Intelligence AI Assists World-First Brain Surgery Artificial Intelligence Google Gemini Scrubs Ums from Voice Text

← Home