A security vulnerability in OCaml’s cohttp library revealed a stark new reality: the mere rumor of a bug is sufficient for AI-powered systems to discover working exploits, making traditional security embargoes obsolete.
Anil Madhavapeddy, who released a fix for a path traversal issue in cohttp 6.3.0, discovered probes in his server logs with the exact bug pattern within minutes of opening a public pull request to fix the issue. Using his own AI agents, he was able to independently create an exploit and probe a live server in under a minute, demonstrating how easily attackers could have exploited the vulnerability before the patch became available.
The timeline was compressed dramatically. After initially discussing the fix privately via Slack (where the bug was itself discovered by Claude Fable), Madhavapeddy opened the PR publicly for broader review. Within ten minutes, his website began receiving automated probes for percent-encoded traversal sequences, indicating that watchers were monitoring repositories in real-time.
According to research cited by Madhavapeddy, when given a CVE description, a GPT-4 agent exploited 87% of a 15-vulnerability benchmark; without the description, it exploited only 7%. This demonstrates that attackers need only a general direction to find exploits. Recent cases show this timeline has inverted entirely: a metric called “mean time to exploit” now stands at -7 days, meaning exploitation precedes public patches. The marimo CVE went from advisory to exploitation attempts in 9 hours with no public proof-of-concept; Langflow’s took 20 hours.
Madhavapeddy argues that conventional security processes—which assume secrecy protects users—no longer function in an era of autonomous exploit generation. The bottleneck has shifted from attackers’ exploit creation to “defender remediation throughput,” according to a May 2026 paper on “bugonomics.” LLM systems generate exploits rapidly, but maintainer validation, triage, and release rates remain flat, favoring attackers.
For smaller open-source projects, the disparity is acute. Major tech companies like Google build microupdates directly into software to reach users faster. Smaller projects like OCaml lack such infrastructure and struggle to access frontier AI models, which Western commercial offerings restrict via security filters. Project Glasswing provides access to 150 organizations across 15 countries, but independent maintainers remain excluded.
Madhavapeddy proposes two potential responses: developing fixes in truly private spaces with robust, encrypted discussion infrastructure separate from leaky platforms; or shipping fixes continuously in public with rapid release cycles, as Chrome does weekly. Each approach faces obstacles—GitHub’s temporary private forks restrict CI access, and continuous shipping requires packaging infrastructure most projects lack.
Key facts
- Within minutes of opening a public PR for the cohttp fix, the researcher observed automated probes exploiting the exact vulnerability pattern
- Using DeepSeek V4 Pro, the researcher independently created a working exploit in under a minute, demonstrating how easily attackers could exploit the bug pre-patch
- Mean time to exploit is now -7 days, meaning exploitation typically precedes public patches and patches are released after exploitation begins
- A GPT-4 agent exploited 87% of vulnerabilities when given a CVE description, versus 7% without one
- Recent CVEs show exploitation starting within hours: marimo’s CVE-2026-39987 in 9 hours, Langflow’s CVE-2026-33017 in 20 hours, all without public proof-of-concept code
- The security bottleneck has shifted from attackers’ exploit generation to maintainers’ ability to validate, triage, and release fixes