Cohttp patch drew traversal probes within 10 minutes as agents turn bug hints into exploits
- After maintainer Anil Madhavapeddy publicly opened a PR for cohttp 6.3.0's path traversal fix, his web server received percent-encoded traversal probes within about 10 minutes.
- Madhavapeddy asked DeepSeek V4 Pro to investigate path normalization in the affected code; it found related issues, and his agent built a local-server exploit in under a minute.
- The author argues that security embargoes no longer protect users when an agent needs only a broad issue class, a public commit, or another small clue to search for an exploit.
- A cited GPT-4 agent study exploited 87% of 15 vulnerabilities when given CVE descriptions, versus 7% without descriptions; the article also cites a 2026 mean time to exploit of -7 days.
- The May 2026 "bugonomics" paper cited by the author says defender remediation throughput is the bottleneck because maintainer validation, triage, and release capacity have not risen with exploit generation.
Hacker News 의견들
I maintain rclone, and we got over 40 security disclosures in the last month after about 20 in its first 10 years. About 75% contain something worth investigating, and even with AI triage and fix suggestions, the volume takes a huge amount of time.
GitHub used to assign CVEs in 2-3 days, but now I am seeing 3-4 weeks. I have to ship point releases with CVE-PENDING in the changelog.
I would batch roughly 10 related security patches on a branch, verify them together, then send them through review and CI/CD as one group. The irreducible review time can cover several bugs at once.
This was always part of exploit development. People have long reconstructed PoCs from patches, commit messages, and stray hints, but LLMs have scaled it to mass exploitation by low-skill actors.
It used to take days or weeks of research, testing, and reverse engineering to get from a patch hint to a PoC. Now reading commits, reverse engineering binaries, building an exploit, and scripting scans can be automated in minutes or hours.
Finding and fixing bugs is easier, but management still chooses feature speed over fixes. AI will not change software quality if organizations refuse to spend time shipping fixes.
I have worked at places that shipped major known bugs with a vague plan to fix them later, then kept prioritizing features. If exploitation and fixes become cheap, repeated compromises may finally force companies to take security fixes seriously.
Companies that slow-roll security fixes may have to move faster once AI speeds up exploitation and insecure software creates more liability.
Memory-safe languages are missing from this discussion. They cannot fix existing projects or logic errors, but they significantly reduce exploitable memory bugs, apart from escape hatches such as unsafe.