TL;DR
With AI, the time between a vulnerability being disclosed and being exploited has shrunk to hours or even minutes, rendering traditional security processes obsolete and forcing open-source maintainers to adapt.
The author released a security patch for OCaml's cohttp library, fixing a path traversal bug. By old routine, such issues are fixed privately, affected users get notified, and only then a public advisory goes out.
Not this time. Minutes after the author pushed the fix to a public repository, scans against the exact bug pattern showed up in his server logs.
Rumour as a treasure map for attackers
With only a vague direction, AI can find the bug and craft an exploit on its own. The author asked his own AI assistant to try; it produced a working exploit against a local server in under a minute.
Researchers found that when given a CVE description, an AI agent exploited 87% of 15 vulnerabilities; without it, only 7%. And now the average time-to-exploit has gone negative — meaning attacks often precede the patch.
The old embargo playbook is broken
The old approach was secrecy: assume that keeping bug details private protects users. But today's AI needs only a hint — a question on a mailing list, a suspicious commit — to research an attack method itself.
So the author argues the open-source security response must change. He proposes three things: develop patches somewhere truly private but still inform the right people; ship fixes faster, like Chrome's weekly updates; and add 'virtual patches' at the protocol layer, deploying temporary defenses before the full fix lands.
Curated from high-quality sources, with concise summaries and key takeaways.
