cohttp maintainer saw exploit probes ten minutes after opening path traversal fix

OCaml's cohttp library shipped version 6.3.0 on 22 August 2026 with a fix for a path traversal vulnerability. What should have been a routine coordinated disclosure instead demonstrated how far AI-assisted attack tooling has compressed security timelines: within roughly ten minutes of the fix being opened publicly, the maintainer's own live webserver was logging probes built around that exact bug. The account, published on the maintainer's blog and picked up on the Hacker News front page, argues that the mere rumour of a vulnerability is now enough for attackers to reconstruct an exploit.

How the report arrived

The original report reached the maintainer privately over Slack, relayed via Jane Street, and the finder was itself an AI agent, Claude Fable, according to the post. Before writing the patch, the maintainer pointed their own agents at the affected code and asked them to investigate path normalisation. Claude's Fable refused outright, citing its security restrictions — the maintainer lacks access to Project Glasswing, the programme that gates such research use — while DeepSeek V4 Pro complied, independently surfaced several related issues, and generated a working exploit against a local live server in under a minute.

After iterating on candidate fixes with the reporter, the maintainer opened cohttp pull request #1145 in public to gather review, a stage that normally takes days with a release following within a week or two. Ten minutes later the site was receiving requests containing percent-encoded traversal sequences, which the maintainer reads as evidence that automated watchers monitor public repositories for security-relevant changes. If a local exploit took one minute to assemble, the post notes, ten minutes is a generous window for a fully automated attacker.

The numbers behind the collapse

The post anchors the anecdote in research. In work by Fang et al., a GPT-4-based agent given only a CVE description exploited 87% of a 15-vulnerability benchmark; without the description it managed 7%. A description is now close to a complete exploit blueprint. Citing Vulncheck data, the post puts mean time to exploit at roughly -7 days — attacks on average precede the patch — compared with about 63 days in 2018-19 and a crossing of zero in 2024. Recent examples include marimo's CVE-2026-39987, which saw a first exploitation attempt nine hours after the advisory despite no public proof-of-concept existing, and Langflow's CVE-2026-33017 at twenty hours.

Bugonomics and the defender bottleneck

A May 2026 paper by Pesoli et al., 'Demystifying the Mythos or Disrupting Bugonomics?', argues the bottleneck has moved from finding bugs to fixing them, a shift it frames as defender remediation throughput. Models and program analysis can generate findings and exploits quickly, while maintainer validation, triage and release rates stay flat. The cohttp maintainer agrees from experience, noting that a regression-free security patch is inherently more work than a quick fix, and describing a surge of machine-generated reports since Fable appeared, with the share of synthetic submissions still unmeasured. Access is also uneven: commercially available Western models block this class of security work, and Project Glasswing — 150 organisations across 15 countries, including critical infrastructure operators, cloud and financial providers and the Linux Foundation — still excludes small independent maintainers.

What the post proposes

Two remediations are sketched. The first is to develop fixes somewhere genuinely private and to ensure the issue description reaches only the right people. GitHub's temporary private forks nominally qualify, but per the post they block CI integrations, permit only a single merging pull request — awkward for fixes spanning several repositories — and require reviewers to be enrolled one at a time. The maintainer adds that patch secrecy is the smaller problem: because agents can work from a hint, controlling the spread of the description matters more. Open-source security discussion is scattered across end-to-end encrypted channels and shared platforms such as Discord and Slack that leak easily, prompting a call for a web-of-trust to distinguish friendly researchers from adversaries.

The second is to abandon embargoes, fix in public and ship continuously. Chrome is cited as evidence this scales: weekly security updates, two releases per week, and dynamic patching that swaps in updated binaries without a restart. The Linux kernel defers fixes at most seven days, fourteen exceptionally. The post concedes the model transfers poorly — OCaml and Docker do not control the endpoints their software runs on, and downstream distributions repackage on their own schedules. The source text is cut off mid-argument at this point, leaving the packaging question unanswered.

Why it matters

Coordinated disclosure assumes details stay secret between the private fix and the public advisory. If a rough hint — a commit, a mailing-list question, a context leak — lets an agent rebuild an exploit within minutes, then investigating or disclosing a bug becomes itself a signal that helps attackers. For maintainers, release speed and automation are now security features, and patch latency is attack surface. For anyone consuming open source, the risk concentrates in the gap between a fix existing and every downstream deployment actually running it.