AI agents can now weaponize software bugs from vague rumors alone

Attackers no longer need public exploit code to hack open-source projects—a vague rumor about a bug is enough for AI agents.

An OCaml maintainer released a security patch for cohttp 6.3.0 to fix a path traversal flaw. Within ten minutes of opening a public pull request, automated scanners hit his live webserver. To test how fast AI works, he gave DeepSeek V4 Pro a simple prompt about path normalization issues in the codebase. The model built a working local exploit in under a minute.

Why it matters: Average time to exploit dropped from 63 days in 2018 to negative days today. Exploitation now happens before official patches ship. Recent security disclosures for tools like marimo and Langflow saw automated attacks within 9 to 20 hours, even without any published proof-of-concept.

Know this: Researchers call this gap a "bugonomics" crisis. Attackers use AI to generate exploits in seconds, while human maintainers still have to manually write, test, and safely release clean code fixes.

The safety window between finding a software bug and weaponizing it has officially hit zero.