saved
Just a rumour of a bug is enough to find a security exploit these days
gist
Anil Madhavapeddy saw matching probes minutes after opening a public cohttp path-traversal fix, and his agents reconstructed an exploit from only a rough description in under a minute. He argues OSS embargoes no longer buy time: mean time to exploit is now negative, and a rumour is enough for agentic search. Maintainer validation and release throughput are the bottleneck. He wants private discussion, continuous shipping despite packaging drag, and protocol-layer virtual patches that can deploy before a full library fix lands.
ideas
- A rumour is enough. Agents need only a search direction; Madhavapeddy's tools built a local cohttp exploit in under a minute, and probes hit his server about ten minutes after the public PR.
- Embargoes assume secrecy still buys time. Mean time to exploit is now -7 days, so exploitation often precedes the patch; Fang et al. showed a CVE description lifted GPT-4 exploit success from 7% to 87%.
- The bottleneck is defender throughput. LLMs generate exploits and reports faster than maintainers can validate, prioritize, and ship regression-free fixes ("bugonomics").
- Secret patches plug the wrong leak. The description must reach the right people without leaking; GitHub private forks cut CI, limit PRs, and poorly fit drive-by OSS review.
- Ship faster, and patch the protocol. Continuous release is blocked by downstream packaging; virtual rules such as normalizing percent-encoded path separators can protect endpoints before the library fix lands.
quotes
“just the rumour of a security issue seems enough to give attackers enough info to find new exploits”
“all an agent needs today is a broad direction to search in, and it can do its own research”
“The patch staying secret isn't nearly as important as ensuring the description about the issue reaches exactly the right people with no leakage to attackers.”
“If we just accept that upstream patch fixes will always trail an exploit, then we must put something faster to get ahead.”