Rumour of bug enough to find exploit
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Anil Madhavapeddy fixed OCaml's cohttp path traversal, but probes hit his server minutes after the PR. Just a rumour of a bug now lets AI agents find exploits, breaking security.
Background
Anil Madhavapeddy, an OCaml maintainer, released a security fix for cohttp 6.3.0 addressing a path traversal vulnerability. Within minutes of opening the public pull request, his webserver logs showed probes matching the bug pattern, indicating automated watchers. He also found that his own AI agents could create exploits just from knowing the bug's general nature, highlighting a shift where LLMs can generate exploits faster than maintainers can patch.
How it unfolded
- recentlyAnil Madhavapeddy released cohttp 6.3.0 fixing a path traversal issue, but noticed probes in his webserver logs minutes after opening the PR.
- recentlyHe used his own agents to find the exploit just by knowing roughly what it was about, and created an exploit in under a minute.
- recentlyHe points to data showing mean time to exploit is now -7 days, meaning exploitation precedes the patch.
Who’s saying what
- Maintainer
- Anil Madhavapeddy argues that conventional security embargoes are no longer effective because just a rumour of a bug is enough for AI agents to find and exploit it.
- Analysts
- Fang et al. found that GPT-4 agents exploited 87% of a 15-vulnerability benchmark when given CVE descriptions, versus 7% without.
- Caution
- The 'bugonomics' paper argues the bottleneck has moved to defender remediation throughput, as LLMs generate exploits faster than maintainers can patch.
Still unverified
The claim that probes appeared within ten minutes of opening the PR is based on the author's own logs and has not been independently verified.