Just the rumour of a bug is enough to find an exploit these days

A recent security fix for OCaml's cohttp 6.3.0 revealed how easily an exploit could be created from just a rumor of a bug. The patch was straightforward, but the security fix process typically involves private fixing, informing users, and issuing a public advisory. However, this time, probes were found in the live webserver logs shortly after opening the PR to fix the issue.

The reporter could have exploited the vulnerability using their own agents, just minutes after the patch was made available. This highlights the need to change the way we handle security responses in open source.

The timeline of events was compressed, with the bug reporter finding it via Claude Fable, and the author using DeepSeek V4 Pro to find several related issues. In under a minute, an agent created an exploit to probe a local live server. Automated watchers are now keeping an eye on public repositories, and a determined attacker could exploit vulnerabilities within seconds.

Conventional security processes assume that secrecy of the details protects users, but LLMs can now generate exploits using just a broad direction to search in. A study found that when given a CVE description, an LLM-expert agent could exploit 87% of a 15-vulnerability benchmark, compared to just 7% without the description. With the mean time to exploit now around -7 days, it precedes the patch.

The author argues that our security processes need to adapt, as just one person searching for the issue class can alert an agent and let them create exploit code. Maintainer capabilities may be flat due to not having access to frontier agents like Mythos, and the engineering of a security patch that doesn't cause regressions is more work.

Smaller projects like OCaml struggle to gain access to frontier models. The author suggests that technical debt remediation, semantics-grounded, tool-verified, model-assisted workflows could help maintainers find, validate, prioritize, and fix security-relevant defects before they become exploited vulnerabilities.