Anil Madhavapeddy, a computer science professor at Cambridge and core maintainer of the OCaml compiler, reports that security issues in OCaml projects now show evidence of attempted exploits within minutes of patches being shared for discussion. He notes that this website was fielding probes for percent-encoded traversal sequences about ten minutes after public repositories opened, indicating automated watchers are monitoring them constantly. Modern coding agents have become so effective at finding flaws that the slightest hint at a new bug provides enough information for them to locate it. Madhavapeddy demonstrated this capability using his own agents, switching to DeepSeek V4 Pro when other models refused the task. This rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, communities need new processes for keeping themselves safe. Nick Craig-Wood, maintainer of rclone, confirms his project is seeing this problem, noting a surge from twenty security disclosures in ten years to over forty in the last month. He states that about seventy-five percent of these disclosures contain something requiring investigation. GitHub now takes three to four weeks to assign CVEs, forcing him to release point updates with pending status.
The speed at which artificial intelligence identifies vulnerabilities undermines the traditional timeline for responsible disclosure. Open source maintainers face an overwhelming volume of false positives alongside genuine threats, straining their limited resources. The current embargo model no longer protects projects from automated exploitation.
- Automated agents can find exploits within ten minutes of patch disclosure
- GitHub CVE assignment times have increased from days to weeks
- Over seventy-five percent of recent security disclosures require investigation
