Anil Madhavapeddy is a professor of Planetary Computing at the University of Cambridge and one of the maintainers of the OCaml programming language. In a recent blog post he sounded the alarm about a worrying trend in cybersecurity, now that your adversaries have access to increasingly powerful AI models and tooling: Within minutes of a bug disclosure, attackers are deploying AI-generated exploits:
This normally takes a few days and a release within a week or two is reasonable. Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories.
AI expert Simon Willison points out:
Modern coding agents have become so effective at finding flaws that the slightest hint at a new bug can be enough information for them to find it, something Anil has been able to demonstrate using his own agents, switching to DeepSeek V4 Pro when Claude Fable refused the task. […] Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe.
Prepare yourself for a rapidly increasing number of AI-generated exploits, and if you are in IT, the necessity to apply patches within minutes of disclosure. Personally, I think the vast majority of companies are not ready for this.
