GoKawiilAI agents found cohttp path-traversal exploit within minutes of PR being opened
OCaml maintainer Anil Madhavapeddy disclosed a path traversal vulnerability in cohttp 6.3.0 and found that attackers began probing his live server with the exact exploit pattern just minutes after he opened a public GitHub pull request to fix it. He also demonstrated that AI coding agents like DeepSeek V4 Pro could independently rediscover the bug and build a working exploit in under a minute, using only a vague description of the issue.
GoKawiil's interpretation of the reporting above, not reported fact.
Traditional open-source security embargoes rely on the assumption that fixing a bug privately buys defenders time before attackers can weaponize it, but AI agents capable of rapid code analysis and exploit generation are collapsing that window to near zero. This forces maintainers to rethink disclosure norms entirely, since even hinting at a vulnerability's existence may now be enough for automated systems to find and exploit it before a patch ships.
- A cohttp path traversal bug was probed by attackers within 10 minutes of a public fix PR going up.
- AI models like DeepSeek V4 Pro could independently rediscover and exploit the bug from vague descriptions.
- Standard open-source embargo practices may no longer provide adequate protection time against AI-assisted attackers.
YubiKey 5 NFC Security Key — If AI-assisted exploit hunting is collapsing the window between disclosure and attack, hardening your own accounts is the easy win. The YubiKey 5 NFC gives maintainers phishing-resistant hardware two-factor for GitHub, npm, and SSH signing, so a leaked password alone can't put your repos or release pipeline at risk.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: anil.recoil.org — Anil Madhavapeddy, 2026-08-28
Published there as: “Just the rumour of a bug is enough to find an exploit these days”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.