Cambridge computer science professor and OCaml compiler core maintainer Anil Madhavapeddy disclosed this week: once a patch was discussed on the public mailing list (the communication group where developers privately discuss fixes), his server received automated vulnerability probes within ten minutes — whereas such attacks used to wait days until a patch was officially released.
The root cause is a leap in capability from AI coding assistants (AI tools that help write code and audit code) — as long as there's a hint of "there may be a bug here" in public channels, AI can extract the complete vulnerability. Anil reproduced this in his own experiment: after Claude refused, he used DeepSeek V4 Pro to successfully complete the vulnerability-finding task.
What this is
Traditional open source software (publicly available source code, free-to-use software) security fixes follow a "tacit agreement": maintainers discuss privately, prepare patches, then announce in unison, giving downstream users reaction time. The industry calls this the "embargo window" (a customary confidentiality period).
That tacit agreement is failing. Nick Craig-Wood, maintainer of rclone — the open source file synchronization tool — added in a Hacker News comment: his project received a cumulative ~20 vulnerability disclosures in its first ten years, but in just the past month received over 40, with 75% of them being legitimate. GitHub's pace of assigning CVE numbers (Common Vulnerabilities and Exposures — essentially an ID card for each vulnerability) has stretched from two or three days to three or four weeks. Nick can only release new versions with "CVE-PENDING" marked first.
Industry view
The good news: the same AI tools are also helping defenders. Nick explicitly said he uses AI for vulnerability triage (judging severity and fix priority) and drafting fixes — without AI, he simply couldn't keep up. Anil's experiment itself proves this — AI is a double-edged sword, deployed on both attack and defense sides.
But the more concerning side: open source maintainers are basically volunteers or a small number of dedicated staff, fighting a "one-to-many" battle against endless AI scanners. Anil states bluntly that this discovery speed is no longer compatible with current embargo practices — the community needs new processes, or the open source ecosystem turns into a dangerous game of "whoever finds it first gets to use it first." Some developers have proposed sending patches to major downstream enterprises before public disclosure, but this involves trust and legal liability, and there's currently no consensus.
Impact on regular people
For enterprise IT: Once a vulnerability appears in the open source components we rely on, the window from public discussion to potential exploitation may be just hours, not weeks. Ops teams need to proactively subscribe to upstream mailing lists and announcements — we can't wait for CVE numbers to act.
For individual careers: Demand for security engineers and Application Security (AppSec) roles is rising; new roles like "AI security operations" and "AI red team testing" (simulating attackers using AI to find vulnerabilities) are emerging — a transformation direction worth watching early for tech professionals.
For consumer markets: Once issues hit the open source dependencies behind everyday apps, the fix chain is compressed — software updates will be more frequent; the cost of delaying with "I'll install it later" is rising.