Clarion Street

The End of the Embargo: How AI Agents Broke the Rumor-as-Secret Model

·7 min read

On October 3, Anil Madhavapeddy shipped cohttp 6.3.0, a fix for a path-traversal bug in the OCaml HTTP library he helps maintain. The bug had been reported privately the week before, through Jane Street on Slack, and the fix itself was straightforward. The normal routine would have been to patch quietly and publish an advisory later. Instead he opened the fix as a public pull request, cohttp #1145, so more reviewers could see it. Within about ten minutes his own webserver logs were showing probes for the exact percent-encoded traversal pattern the patch addressed [1].

What happened next matters more than the ten minutes. Madhavapeddy pointed his own agent, DeepSeek V4 Pro, at the affected code, and it produced a working exploit in under a minute, knowing only roughly what the bug was about [1]. He did not have the details. He had a direction, and that was enough to build the exploit before the public patch existed.

I have written twice about how AI made exploitation faster, once on discovery outrunning remediation and once on the gap between machine-speed attack and human-speed defense. This is not a third version of that. The cohttp note shows something else, and it is the more important claim. The embargo, the whole coordinated-disclosure model, rested on one assumption: that keeping the details secret was a security control. That assumption is now false, because an agent needs the rumor, not the details.

The description is the secret

Fang et al. demonstrated the mechanism two years ago. A GPT-4 agent given a CVE description exploited 87 percent of a 15-vulnerability benchmark. Without the description, 7 percent. GPT-3.5, open-source models, and scanners like ZAP and Metasploit managed zero [3]. The gap between 87 and 7 is the entire value the embargo was selling, and it has collapsed.

Madhavapeddy states the operational version: one person searching for an issue class, whether through a mailing-list question, an odd commit in an orphan branch, or a context leak, is enough to alert someone else’s agent and hand it a working exploit [1]. The secret that matters is no longer the patch. It is the description of the bug, and the description leaks through the ordinary machinery of open-source work.

Sysdig’s threat research team saw the same thing twice this year. A marimo notebook flaw was exploited 9 hours and 41 minutes after its advisory with no public proof of concept, and a Langflow flaw was hit within 20 hours, also with no public PoC [7][8]. Neither case had a patch diff to reverse or a PoC to copy.

This is why the usual first fix does not work. GitHub’s temporary private forks exist so maintainers can patch in private, but Madhavapeddy’s account is specific about why they fail: they disconnect CI, they allow one pull request into the fork, and reviewers have to be enrolled by an admin one at a time. In open source, reviewers are drive-by, whoever is available that week. More than that, the private fork plugs the wrong leak. Keeping the patch secret is less important than making sure the description reaches only the right people, and open source has no robust infrastructure for that discussion. It runs through Matrix and through Discord and Slack, which leak [1].

Projects are giving up on the embargo

QEMU has already stopped pretending. Its security process now states that maintainers will “generally reject requests for arbitrary embargoes” unless high-severity circumstances can be demonstrated, and it says why: any disclosure from automated tools is “highly likely to be independently re-discovered, potentially many times over in a very short timeframe” [5]. The project has also stopped accepting security disclosures by email, routing everything through confidential GitLab issues and keeping the confidential window to the minimum needed to write a patch [5].

That is a policy change, not a paper. It is a mature project concluding that the embargo no longer buys anything.

The economics have inverted

There is a name for what happens next, from a May 2026 paper by Pesoli, Errico, and Cavallaro: bugonomics [4]. Their argument is that the bottleneck has shifted. Finding bugs is cheap now, because agents make candidate generation, harness construction, and report drafting cheaper at codebase scale. What has not scaled is “defender remediation throughput,” their phrase for absorbing, validating, triaging, patching, and shipping a larger report stream [4]. The scarce resource is no longer discovery. It is maintainer review and release work.

Maintainers feel it as a firehose. Nick Craig-Wood, the creator of rclone, is quoted saying the project saw about 20 security disclosures in its first ten years and more than 40 in the last month [2]. That figure is secondhand, attributed through InfoQ to a Hacker News comment, and I could not verify the wording. The direction matches everything else, so I am keeping it with that caveat.

Three ways out

Madhavapeddy proposes three responses, and they are worth stating in his terms before I add my own [1].

First, develop fixes in genuinely private channels, with a web of trust so the people discussing a bug are the people who should be. Second, drop the embargo and ship continuously, the way Chrome does with weekly security updates and the Linux kernel does with a seven-day deferral. Third, move the defense to the protocol layer, ahead of the patch. His concrete example is the cohttp bug itself: the mitigation was to normalize percent-encoded path separators in the request URL, and that rule was deployable the moment the report arrived, while the full fix went through review, testing, and packaging [1].

The third one is where this connects to work I already track on this site. A mitigation you can deploy to an endpoint and revoke, without waiting for every client to upgrade, is not a secret you keep. It is a control you can turn on and off. That is the same shape as the short-lived, revocable credentials and protocol-level authorization work on the agent-identity side. The embargo and the static credential failed for the same reason: both assumed a secret could be held. AI collapsed the secrecy window for both, and the repair on both sides is the same move from static trust to control you can revoke.

The case against the alarm

I have to put the strongest counterpoint in, because it is strong. VulnCheck’s first-half 2026 analysis found the share of known-exploited vulnerabilities hit on or before the day the CVE published fell to 23.43 percent, down from 28.93 percent in 2025 [6]. Of 1,061 vulnerabilities attributed to AI-assisted discovery, 14, or 1.3 percent, are confirmed exploited in the wild [6]. Anthropic’s Project Glasswing logged more than 23,000 findings, which became 126 CVEs and one confirmed in-the-wild exploitation [6]. VulnCheck’s own read is blunt: AI-assisted discovery is “overhyped relative to the evidence” [6].

The 87 percent figure is also 2024 hardware. It is GPT-4 against one-day CVEs, before today’s gated frontier models existed. The gating cuts both ways, and Madhavapeddy names it. The bug itself was found with Claude Fable, but when he pointed Fable at the code to look for related issues, it refused outright, and he reached for DeepSeek V4 Pro instead [1]. The Western models have security guards, as he puts it, which is a real brake and a strange one to depend on [1].

The cohttp “ten minutes” is one maintainer reading his own logs. It is good evidence that automated watchers sit on public repositories. It is not a controlled measurement showing that an AI agent specifically did it.

I hold both readings. The embargo is a trust model, and on paper that model is dead, because the information that feeds an agent is the ordinary byproduct of open-source work and no amount of process stops it. The evidence that agents are already converting that information into mass exploitation is thin, though. What changed is that the control our disclosure model was built on is no longer a control, and the replacement is the same revocable-capability architecture the agent-identity side is already building. Whether the exploit wave arrives before that architecture does is still open.

Sources

  1. Just a rumour of a bug is enough to find a security exploit these days — Anil Madhavapeddy
  2. AI Agents Are Disrupting Open Source Security Disclosure — InfoQ
  3. LLM Agents can Autonomously Exploit One-day Vulnerabilities — Fang et al., arXiv:2404.08144
  4. Demystifying the Mythos or Disrupting Bugonomics? — Pesoli, Errico, and Cavallaro, arXiv:2605.24632
  5. Security Process — QEMU Project
  6. VulnCheck State of Exploitation 1H-2026 — VulnCheck
  7. Marimo OSS Python Notebook RCE: Disclosure to Exploitation in Under 10 Hours — Sysdig TRT
  8. CVE-2026-33017: How Attackers Compromised Langflow AI Pipelines in 20 Hours — Sysdig TRT