The Exploit Now Ships Before the Patch
Anil Madhavapeddy — Cambridge professor, OCaml maintainer, not a man given to security hysteria — fixed a path traversal bug in cohttp 6.3.0 and did everything by the book. Then he checked his webserver logs: probes matching the exact bug pattern started arriving minutes after he opened the fix PR. Not after the advisory. After the pull request. The essay is at https://anil.recoil.org/notes/rumour-is-the-exploit and sat at 197 points on Hacker News today.
To confirm what he suspected, he ran the experiment on himself: he gave his own AI agents nothing but a rough rumor of what the bug was about, and they found the working exploit — before the public patch was available. He then cites the numbers that make this systematic rather than anecdotal: Fang et al. found a GPT-4 agent exploited 87% of vulnerabilities when given just the CVE description, and mean time-to-exploit is now minus seven days. Negative. Exploitation precedes the patch.
The uncomfortable conclusion is that coordinated disclosure — the entire social contract of security fixes — was designed for attackers who read at human speed. A fix PR is a rumor, a rumor is a spec, and a spec is enough for an agent. The same day this essay was on the front page, GLM-5.3 shipped downloadable weights that are state of the art at exactly this kind of vulnerability discovery. The defense side has the same tools, but the defender has to patch every server; the attacker only needs the diff.
Related on clauday: GLM-5.3 Weights Are Out. MIT Is Not. — https://clauday.com/article/4a18d5b4-3971-4e0b-8db2-a0f363f3e1b6
← Back to all articles
To confirm what he suspected, he ran the experiment on himself: he gave his own AI agents nothing but a rough rumor of what the bug was about, and they found the working exploit — before the public patch was available. He then cites the numbers that make this systematic rather than anecdotal: Fang et al. found a GPT-4 agent exploited 87% of vulnerabilities when given just the CVE description, and mean time-to-exploit is now minus seven days. Negative. Exploitation precedes the patch.
The uncomfortable conclusion is that coordinated disclosure — the entire social contract of security fixes — was designed for attackers who read at human speed. A fix PR is a rumor, a rumor is a spec, and a spec is enough for an agent. The same day this essay was on the front page, GLM-5.3 shipped downloadable weights that are state of the art at exactly this kind of vulnerability discovery. The defense side has the same tools, but the defender has to patch every server; the attacker only needs the diff.
Related on clauday: GLM-5.3 Weights Are Out. MIT Is Not. — https://clauday.com/article/4a18d5b4-3971-4e0b-8db2-a0f363f3e1b6
Comments