Just a rumour of a bug is enough to find a security exploit these days

Computer science professor Anil Madhavapeddy reports that open-source software projects are facing attempted security exploits within minutes of a patch or bug discussion being shared publicly. In one instance, a website received probes for traversal sequences about ten minutes after a patch was shared, showing that automated watchers actively monitor public code repositories.

Modern coding agents have grown so effective at discovering flaws that even a slight hint of a new bug provides enough information for them to generate exploits. Madhavapeddy demonstrated this capability using AI agents, including switching to DeepSeek V4 Pro after Claude Fable refused the task. This rapid discovery pace breaks traditional open-source embargo practices, which historically allowed days or weeks to safely coordinate releases and patches.

Other open-source maintainers report facing the same overwhelming trend. Nick Craig-Wood, maintainer of the rclone project, noted that his project received about twenty security disclosures during its first ten years, but dealt with over forty in just the last month. About seventy-five percent of these recent disclosures contain valid issues requiring investigation and fixes. Additionally, administrative delays have worsened, as GitHub advisory assignments that once took a few days now require three to four weeks. These rapid exploits and massive increases in disclosures create heavy workloads for maintainers and force them to rethink how communities keep software safe.