AI agents find exploits within minutes of patch hints, overwhelming open-source security
Simon Willison
By
Originally published as “Just a rumour of a bug is enough to find a security exploit these days”
Highlights
- AI agents find exploits within minutes of patch hints
- Rclone received 40 security reports in one month
- CVE assignment delays now stretch to 3–4 weeks
- Current embargo practices are incompatible with AI-speed discovery
- Maintainers need new processes to protect communities
Security researchers are exploiting AI coding agents to find vulnerabilities in open-source projects within minutes of patch discussions—far faster than traditional disclosure timelines. Cambridge computer scientist Anil Madhavapeddy reports that automated watchers detect hints of bugs in public repositories and use AI models like DeepSeek V4 Pro to reverse-engineer exploits before fixes are released. The rclone maintainer confirms a surge: 40+ security disclosures in one month versus 20 over a decade, with a 75% hit rate. This acceleration has overwhelmed existing embargo practices and CVE assignment processes (now taking 3–4 weeks instead of 2–3 days), forcing maintainers to release patches marked CVE-PENDING. The mismatch between exploit discovery speed and responsible disclosure workflows poses a systemic risk to open-source security.
