AI Agents Are Breaking Open Source Security Embargoes

What happened

Anil Madhavapeddy, a Cambridge computer science professor and core maintainer of the OCaml compiler, has argued that AI agents are eroding one of the oldest conventions in open source security: keeping vulnerability details quiet until a fix is ready 2. His argument starts with his own experience. While fixing a path-traversal bug, he saw exploit probes aimed at that weakness within minutes of opening the pull request containing his fix 1.

His broader point is that attackers no longer need a full write-up of a flaw to weaponize it. Small public signals, such as a PR title, a question on a mailing list, or an odd commit, can be enough for an AI agent to work out the vulnerability and produce working exploit code 12. Madhavapeddy describes the situation as "bugonomics" turning against open source maintainers 2.

The evidence behind the warning

Both accounts point to the same research. In a study using a benchmark of 15 vulnerabilities, a GPT-4-based agent successfully exploited 87% of them when it had the CVE descriptions. Without those descriptions, its success rate fell to 7% 12.

That gap is the key to the argument. A modest amount of context separates an agent that mostly fails from one that mostly succeeds. Madhavapeddy appears to go further, suggesting the trigger does not have to be a formal CVE description. It could be any leak of context about the bug class 2. The study numbers come from a small benchmark, so they should not be read as a universal exploitation rate. Still, the direction they point is hard to dismiss: once an agent has a description, its effectiveness rises sharply.

Why embargoes are under pressure

Coordinated disclosure assumes that holding back technical details protects users while maintainers prepare a patch 2. That made sense when turning a vague hint into a working attack took skilled human effort and real time. Over days or weeks, the patch would usually win.

Madhavapeddy's concern is that the time this model depends on is disappearing. In his framing, one person searching for a type of issue is enough to tip off someone else's agent, which can then generate exploit code 2. Open source development happens in public, so the fix process itself releases information. A pull request has to exist before it can be reviewed and merged, and a mailing list discussion has to happen before maintainers can coordinate. Each of those steps can now act as an alarm for automated attackers.

He concludes that security processes "need to invert somewhat" 2. Instead of relying on silence to buy time, projects may have to assume that any public sign of a fix starts a clock that runs in minutes, not weeks.

A difficult position for maintainers

Adrian Mouat, who works in developer relations at Chainguard, has said this leaves open-source maintainers in a difficult spot 2. The tension is easy to see. Open source relies on transparency: public review, public history, and public discussion. Those same features now give AI-assisted attackers more signals to work with.

The practical response highlighted in the coverage is speed. Maintainers will need faster patching and faster releases as the gap between disclosure and exploitation shrinks 2. If a fix cannot stay hidden, the next best option is to get it shipped and deployed before the attacker's agent finishes its work.

How the two accounts compare

The two reports agree on the core facts: Madhavapeddy's path-traversal experience, the 87% versus 7% study result, and the conclusion that embargoes are losing force 12. They differ mainly in emphasis. One focuses tightly on the speed of exploitation, especially the probes that appeared minutes after the PR was opened 1. The other places the episode in a wider discussion of process reform and includes outside reaction from the industry 2.

Analysis: what this means

Taken together, the case is convincing even though it rests on one maintainer's experience and a small study. The underlying logic does not depend on exact numbers. If AI lowers the cost of turning hints into exploits, any security model built on secrecy gets weaker, and open source, which runs in public by design, feels that pressure first.

Embargoes are unlikely to disappear entirely, but they will probably carry less weight. Investment is likely to shift toward reducing time-to-patch and time-to-deploy, and toward thinking carefully about what each public action reveals. For volunteer maintainers who already have too much to do, this demand for speed is a heavy burden. That is arguably the real story: the economics of finding and fixing bugs are shifting faster than the institutions built to manage them.