#open_source_vulnerability

Security researchers are exploiting AI coding agents to find vulnerabilities in open-source projects within minutes of patch discussions—far faster than traditional disclosure timelines. Cambridge computer scientist Anil Madhavapeddy reports that automated watchers detect hints of bugs in public repositories and use AI models like DeepSeek V4 Pro to reverse-engineer exploits before fixes are released. The rclone maintainer confirms a surge: 40+ security disclosures in one month versus 20 over a decade, with a 75% hit rate. This acceleration has overwhelmed existing embargo practices and CVE assignment processes (now taking 3–4 weeks instead of 2–3 days), forcing maintainers to release patches marked CVE-PENDING. The mismatch between exploit discovery speed and responsible disclosure workflows poses a systemic risk to open-source security.

Security researchers are exploiting AI coding agents to find vulnerabilities in open-source projects within minutes of patch discussions—far faster than traditional disclosure timelines. Cambridge computer scientist Anil Madhavapeddy reports that automated watchers detect hints of bugs in public repositories and use AI models like DeepSeek V4 Pro to reverse-engineer exploits before fixes are released. The rclone maintainer confirms a surge: 40+ security disclosures in one month versus 20 over a decade, with a 75% hit rate. This acceleration has overwhelmed existing embargo practices and CVE assignment processes (now taking 3–4 weeks instead of 2–3 days), forcing maintainers to release patches marked CVE-PENDING. The mismatch between exploit discovery speed and responsible disclosure workflows poses a systemic risk to open-source security.