AI Coding Agents Can Now Weaponize Bug Rumors Within Minutes
Computer science professor Anil Madhavapeddy reported that automated coding agents, powered by LLMs like DeepSeek V4 Pro, can attempt exploits within ten minutes of a patch being shared. Additionally, open-source maintainers are experiencing a massive surge in AI-generated security disclosures. This shift drastically reduces the window for vulnerability disclosure, rendering traditional open-source embargo practices obsolete. It also overwhelms project maintainers with a high volume of security reports, straining the open-source ecosystem's defense mechanisms. Madhavapeddy demonstrated the exploit generation using DeepSeek V4 Pro after Claude Fable refused the task, observing probes for percent-encoded traversal sequences shortly after sharing a patch. Meanwhile, GitHub's CVE assignment times have surged from a few days to 3-4 weeks due to the influx of reports.
## BACKGROUND
OCaml is a general-purpose, high-level programming language widely used in static analysis and formal methods. Percent-encoding, or URL encoding, represents characters in a URI, which attackers sometimes exploit using encoded traversal sequences (like encoding dot-dot-slash) to bypass security filters and access restricted files.