↓Skip to main content
Zeitgeist — a spike by Chris Gathercole
  1. Creators/
  2. Simon Willison — Creator of Datasette; co-creator of Django/

Just a rumour of a bug is enough to find a security exploit these days

Blog · Watch/Read · (gathered 2026-08-29)

  • The speed of security exploit discovery has drastically accelerated, with automated watchers and AI coding agents now capable of finding flaws and probing for exploits within minutes of a patch being shared or a bug’s “rumour.”
  • Anil Madhavapeddy (OCaml) observed probes for “percent-encoded traversal sequences” within 10 minutes of patch discussion, demonstrating AI’s effectiveness (e.g., DeepSeek V4 Pro), a sentiment echoed by Nick Craig-Wood (rclone) who saw disclosures surge from ~20 in 10 years to over 40 in the last month.
  • This rapid exploit discovery renders existing open-source security embargo practices incompatible and creates new challenges, such as GitHub’s CVE assignments now taking 3-4 weeks (up from 2-3 days), forcing projects to release with “CVE-PENDING” and highlighting an urgent need for new community safety processes.