AI agents compress open-source vulnerability timelines

The cohttp flaw arose because the library normalized a URI path before decoding percent-encoded characters, allowing encoded separators to evade dot-segment normalization.[5] Madhavapeddy says the vulnerability report arrived privately through a Slack channel via Jane Street and had been found using Claude Fable.[2] He says his agent created an exploit to probe a local live server in under a minute.[2] Within about ten minutes, the website received probes for percent-encoded traversal sequences, while another report says web-server logs showed probes matching the exact bug pattern within minutes.[2][1] The fix was released as cohttp version 6.3.0 on Aug. 20, 2026.[5]

The benchmark Madhavapeddy cites illustrates how much vulnerability detail can matter: a GPT-4 agent exploited 87% of 15 benchmark vulnerabilities when given CVE descriptions, versus 7% without those descriptions.[2] He says mean time to exploit had reached negative seven days, meaning exploitation could happen before a patch.[2] For comparison, he puts the mean at about 63 days in 2018–19 and says it crossed zero in 2024.[2] He also cites marimo’s first exploitation attempt nine hours after an advisory and Langflow’s exploitation in 20 hours.[2] These figures describe cited examples and a benchmark, not a guarantee about every vulnerability.[2]

Madhavapeddy says traditional security embargoes assume that keeping vulnerability details secret protects users.[2] But, he argues, a single person searching for an issue class can provide enough information to alert an attacker’s agent and enable it to produce exploit code.[2] His proposed near-term responses include private vulnerability discussions, faster continuous releases and rapid protocol-level mitigations.[3] Those mitigations could include short-lived credentials, revocable capabilities and controls that protect users without requiring every client to upgrade immediately.[3] The proposals point to response speed and interim safeguards as complements to withholding details, rather than relying on secrecy alone.[2][3]

Madhavapeddy says open-source defenses are constrained by maintainers’ capacity to validate, triage and release fixes.[2] Adrian Mouat of Chainguard warns that a public pull request can expose users to exploitation before a fixed release is available.[3] Mouat says something breaks the fundamentals of open source.[3] Nick Craig-Wood says rclone received about 20 security disclosures through GitHub in its first decade and more than 40 in the following month.[3] He says handling the recent disclosures took substantial time, even with AI tools used to triage reports and propose fixes for review.[3] QEMU has shortened its vulnerability embargoes in response to increasingly rapid and automated discovery.[4]