A rumor of a bug is now enough for an agent to write the exploit

Anil Madhavapeddy, a professor of computer science at Cambridge and one of the maintainers of the OCaml compiler, released cohttp 6.3.0 on August 22 with a fix for a path traversal issue. He opened the pull request publicly so more people would look at it, which until recently was ordinary practice. Within about 10 minutes his live web server was fielding probes for percent-encoded traversal sequences, which means automated watchers are reading public repositories and turning a patch into a target.

The hint was the whole exploit

The report reached Madhavapeddy privately through a Slack channel, and it had itself been found by Claude Fable. Before reading the patch closely he pointed his own agent at the affected code and asked it to investigate path normalization. Claude Fable refused the task under its security block. That block lifts inside Project Glasswing, which is open to 150 organizations across fifteen countries, and Madhavapeddy has no access to it, because the program does not reach small maintainers. DeepSeek V4 Pro took the job and independently surfaced several related issues.

The agent then wrote an exploit and probed a local server with it in under a minute. That is the part that breaks the old process. What the embargo protects is the patch, but the thing worth protecting was the direction to search in, and a direction fits in one sentence.

The measurements were already pointing here

Fang and colleagues showed the shape of this in 2024. Given a CVE description, their GPT-4 agent exploited 87% of a 15-vulnerability benchmark. Without the description it managed 7%. A description is not a proof of concept; it is a paragraph of prose.

The tracking of mean time to exploit that Madhavapeddy cites now sits at minus seven days, which means exploitation precedes the patch. The same figure was around 63 days in 2018 and 2019, and it crossed zero in 2024.

• The advisory for marimo's CVE-2026-39987 drew a first exploitation attempt after nine hours, with no public proof of concept in existence.
• For Langflow's CVE-2026-33017 the same gap was 20 hours.
• Nick Craig-Wood, who maintains rclone, received about 20 security disclosures through GitHub in the project's first 10 years, and more than 40 in the last month alone.
• By his own count about 75% of that recent traffic contained something that needed looking at, so it is not noise that can be filed away.

What a maintainer can actually do about it

Madhavapeddy sets out three directions and none of them is comfortable. Developing the fix somewhere genuinely private is the obvious one, but GitHub's temporary private forks cut continuous integration off from the work, accept only a single merging pull request, and require an admin to enroll each reviewer by hand. For a project whose reviewers show up when they happen to be free, that is not a workflow.

The second is to drop embargoes and ship continuously, the way the Linux kernel defers a fix by at most seven days, and by fourteen in exceptional cases. The obstacle is packaging. A library ends up embedded in downstream products the maintainer does not control, so a fast release upstream is still slow where the code actually runs.

The third is to mitigate at the protocol layer while the real fix goes through review. This bug had a one-rule mitigation, normalizing percent-encoded path separators in the request URL, and that rule was deployable the minute the report arrived. Commercial networks do this routinely; Cloudflare pushed managed rules for Log4Shell back in 2021. Open source has no comparable channel for distributing such a rule.

The same clock now applies to anyone shipping dependencies

The window between a public patch and a working exploit is now shorter than most deployment pipelines. A dependency bump that used to be next sprint's chore belongs in the same category as rotating a leaked key.

Two habits follow from that. Advisory feeds are worth watching for the libraries that are actually deployed, not the ones on a list of intentions. And a mitigation has to be deployable without waiting for the fixed release, because on this timeline the fixed release is the slow path.