From 1 items, 1 important content pieces were selected
Technology News
Technology News
Bug Rumours Now Trigger AI Exploit Probes Within Minutes ⭐️ 7.0/10
Anil Madhavapeddy, a Cambridge professor and OCaml compiler maintainer, reports that security patches in OCaml projects are being probed for exploits within about ten minutes of being shared, with automated watchers targeting percent-encoded traversal sequences. He says modern coding agents are so effective that a rumour of a bug is enough for them to find it, and he demonstrated this with his own agents, switching to DeepSeek V4 Pro when Claude Fable refused the task. rclone maintainer Nick Craig-Wood confirms the trend, saying his project received over 40 security disclosures in the last month compared with about 20 in its first ten years, and that roughly 75% contained something worth investigating. Craig-Wood also notes GitHub CVE assignment has slowed from 2-3 days to 3-4 weeks, forcing point releases with CVE-PENDING in changelogs. Madhavapeddy argues this speed is incompatible with existing open source embargo practices and that new processes are needed.
rss · Simon Willison · Aug 28, 22:12
「Background」 Open source projects traditionally rely on coordinated disclosure: maintainers share a patch privately or in public discussion, then release after a short embargo so users can update before attackers weaponize the fix. AI coding agents can now analyze patches and repository changes automatically, so public discussion of a vulnerability can be enough for automated systems to construct and launch exploit attempts.
「Impact」 Open source maintainers now face a flood of AI-generated security disclosures and exploit probes, with rclone alone seeing more than 40 disclosures in a month and CVE assignment delays stretching to weeks, forcing releases with CVE-PENDING entries. This makes existing embargo-based disclosure practices untenable and increases pressure on maintainers to triage and fix issues faster.
Tags: #AI security, #software engineering, #open source, #vulnerability exploitation, #OCaml