Just a rumour of a bug is enough to find a security exploit these days
Just a rumour of a bug is enough to find a security exploit these days Anil Madhavapeddy is a professor of computer science at Cambridge and a core maintainer of the OCaml compiler. In this somewhat alarming post he reports that security issues in OCaml projects are seeing evidence of attempted exploits within minutes of…
Opening of the original on Simon Willison
Summary
Automated security exploits now target OCaml projects within minutes of patches being discussed, a dramatic acceleration from previous days. Anil Madhavapeddy, a Cambridge professor, observed this rapid exploitation, noting that even a rumor of a bug is enough for modern coding agents to find flaws. This speed challenges traditional open source security practices. Anthropic's Claude Fable was reportedly unable to perform the task, with DeepSeek V4 Pro succeeding. The findings suggest a need for new community safety processes.
Why it matters
This development signals a significant shift in cybersecurity, where AI coding agents can find and exploit vulnerabilities almost instantly. This affects open source projects and their maintainers, forcing a reevaluation of disclosure and patching timelines. Competitors like Google Gemini and Meta AI also have advanced coding capabilities, making this a broad industry challenge. Future focus should be on how communities adapt their security workflows to this accelerated threat landscape, potentially requiring faster patch deployment or new forms of vulnerability management.
Related: OpenAI: Introducing GPT-6 Astra: the most intelligent and aligned model in the world. · Google: Agent Plugins package your skills, tools, and more · Microsoft: GitHub Copilot app for Beginners: Run several agents at once · Meta: Meta Muse Code & Muse Spark Course – Build AI Agents, APIs, and Full-Stack Apps · xAI: Ajeya Cotra – "This might be the clearest warning shot we ever get"
Rated middle: a real update, not a headline event.
- The Most Overhyped and Underhyped New AI ModelsMatt Wolfe · Web · Sep 2, 2026
- Sam Altman :‘AGI in 2026’, just as Models Start to [Mis]Train ThemselvesAI Explained · Web · Aug 27, 2026
- Breaking Claude Code Opus 5 Auto ModeSimon Willison · Web · Aug 27, 2026
- Claude, Codex, and Hermes installed unowned code inside corporate networksArs Technica AI · Web · Aug 27, 2026
- The Most Overhyped and Underhyped New AI ModelsMatt Wolfe · Web · Sep 2, 2026
- Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented AgentsarXiv cs.AI · Web · Sep 1, 2026
- Claude Mythos: Highlights from 244-page ReleaseAI Explained
- Automated researchers can reliably mitigate alignment failuresAnthropic Research
- Model Hardware Standard: AI operating physical equipmentAnthropic on YouTube
- Breaking Claude Code Opus 5 Auto ModeSimon Willison
- Sam Altman :‘AGI in 2026’, just as Models Start to [Mis]Train ThemselvesAI Explained
- Patterns and problems in multiagent systemsAnthropic Research
Questions people ask
- What is the new security threat observed in OCaml projects?
- Automated watchers and AI coding agents now probe for security exploits within minutes of patches being shared for discussion, a drastic acceleration of previous timelines.
- Why is this happening so quickly?
- Modern coding agents have become highly effective at finding flaws, and even a rumor or early discussion of a bug provides enough information for them to locate exploits.
More from Simon Willison 10 more
Page generated Sep 3, 2026. Summaries are Subvolts' own; the story belongs to Simon Willison.