Anil Madhavapeddy, a professor of computer science at the University of Cambridge and a core maintainer of the OCaml compiler, reports that security issues in OCaml-related projects are seeing attempted exploits within minutes of patches or discussions being published. In his post he notes that some sites began receiving probes for percent-encoded traversal sequences in roughly ten minutes, suggesting that automated watchers are monitoring public repositories.
What was observed
- Madhavapeddy says that historically such exploit attempts took a few days to appear and a release within a week or two was reasonable. Now, even a small public hint about a bug can trigger immediate probes.
- He demonstrates that modern coding agents have become effective enough that minimal information can enable them to locate flaws. In his experiments he switched to DeepSeek V4 Pro when Claude Fable would not complete the task.
Reports from other projects
Nick Craig-Wood, maintainer of the rclone project, confirmed in Hacker News comments that rclone is experiencing a similar surge. He reports that in the first ten years of the project they received about 20 security disclosures via GitHub, whereas in the last month they have had to handle over 40. Craig-Wood says triaging and producing fixes has consumed a large amount of his time despite using AI tools. He estimates the hit rate for those disclosures at about 75%, meaning most reports contain something that requires investigation.
Impact on CVE and handling processes
Craig-Wood also notes that GitHub used to assign CVEs for advisories in 2–3 days, but under the current load that assignment time has stretched to 3–4 weeks. As a result, maintainers have been releasing point updates with CVE-PENDING in the changelog, which is not ideal from a security-communication perspective.
Why this matters
The combination of generative AI and automated monitoring appears to significantly accelerate the time between a public hint of a bug and an attempted exploit. That speed challenges existing open-source embargo and responsible-disclosure practices: if an issue can be weaponized within minutes, communities must reconsider processes to keep users and maintainers safe.
Steps for the community
Commenters and project maintainers suggest revisiting how sensitive issues are handled, including coordinated disclosure practices, faster security response mechanisms, and increased administrative support for high-traffic projects to reduce delays caused by overload. The experiences reported by OCaml and rclone maintainers indicate that administrative and technical defenses need updating to match the rapid evolution of the tooling landscape.
