Ten minutes from a public patch to live exploit probes

Anil Madhavapeddy, the long-time maintainer of OCaml's cohttp web library, published a public patch for a path-traversal bug on 22 August. Within roughly ten minutes of the pull request going live, his own webserver's logs were filling with percent-encoded probes for the same flaw.

Path-traversal is a well-trodden bug class, and a public fix describes the vulnerability in code with a diff attached. There is no longer a gap between the moment a patch is public and the moment an attacker can read what was patched.

The same afternoon, Madhavapeddy pointed an off-the-shelf AI agent at the affected code with a broad direction ("investigate path-normalisation issues") and watched it produce a working local exploit in under a minute. Claude Fable, Anthropic's safety-trained assistant, refused the same request. DeepSeek V4 Pro obliged.

The pattern is not specific to OCaml. The post cites Sysdig threat-intelligence write-ups on the marimo notebook project, which saw exploitation attempts within nine hours of its advisory, and the Langflow visual-AI builder, which saw them within twenty hours, in both cases without a public proof-of-concept. Per the same post citing Google Cloud's M-Trends 2026 report, the mean time to exploit is now negative seven days, meaning exploitation precedes the patch on average, down from roughly sixty-three days in 2018 and 2019 and crossing zero in 2024.

The mechanism has a 2024 benchmark. Fang and colleagues found that their GPT-4 agent exploited 87% of a fifteen-vulnerability test set when given a CVE description and only 7% without one, in work posted to arXiv as 2404.08144. A public signal, whether a CVE, a commit message, or a pull-request title, was the difference between a working exploit and a coin flip. The claim generalises: any public fix now converts into exploit code faster than a private fix can be distributed to downstream users.

A separate paper from Pesoli and colleagues in May 2026 reframes the asymmetry: the bottleneck has moved from finding bugs to remediating them. The cost of producing an exploit has collapsed; the cost of patching an open-source dependency tree has not. Enterprise defenders using a safety-trained model get a slower version of the same workflow, while an attacker using a permissive model gets a faster one with no filter on the output.

Madhavapeddy sketches three paths forward. The first is a "super-private" patch-development process with web-of-trust discussion infrastructure, the kind of disclosure channel that worked when the public signal arrived days after a fix shipped. The second is to drop embargoes entirely and ship continuously with better cross-ecosystem packaging, accepting that any release is a live attack window. The third is a protocol-layer virtual patch, what he calls an "antibotty" network, that lets a content delivery network or reverse proxy rewrite malicious paths before they reach vulnerable code.

The maintainer is not a neutral observer. Madhavapeddy runs a Cambridge MPhil group, maintains cohttp, and is a named advocate for Anthropic's Project Glasswing, which per a 2026-06-03 Help Net Security article cited in the post expanded in June 2026 to 150 organisations across 15 countries without extending to individual open-source maintainers. The constructive argument is his; the data is shared.

Madhavapeddy's cohttp 6.3.0 release is now on the OCaml security advisory feed. The next public release of any well-trafficked open-source web library is the next benchmark for how much further the line can move.