Rumour Is the Exploit — AI agents collapse time-to-exploit to near-zero

What it is

A field report from the maintainer of OCaml's cohttp, tied to the security fix in cohttp 6.3.0 (path traversal) and public PR cohttp#1145. Beyond the thesis the summary states, the piece carries specific metrics and a model-access argument worth pulling out.

The numbers it cites

• Fang et al.: a GPT-4 agent exploited 87% of a 15-vulnerability benchmark when given the CVE description, versus 7% without it. The description — not a PoC — is the enabling input.
• Mean time-to-exploit trajectory: ~63 days in 2018–19, crossed zero in 2024, now -7 days (exploitation precedes the patch).
• Corroborating recent cases: marimo CVE-2026-39987 went advisory-to-first-exploitation in 9 hours with no public PoC; Langflow CVE-2026-33017 in 20 hours.
• His own agent built a working local exploit in under a minute; public probes for percent-encoded traversal hit his live server ~10 minutes after the PR opened.

The point the summary omits: model-access asymmetry

When the author pointed a frontier model (Fable) at the code, it refused due to a security block gated behind Project Glasswing — which he lacks access to. DeepSeek V4 Pro complied and turned up several related issues. Glasswing now spans 150 organisations across 15 countries (critical infra, cloud/financial providers, the Linux Foundation), but small/independent maintainers are excluded. The operational consequence: defenders on small projects are guard-railed out of the very tools attackers use via unguarded open-weight models.

flowchart TD
    R[Rumour: PR / commit / mailing-list question] --> A[Attacker agent + unguarded model]
    R --> M[Maintainer]
    A --> X[Working exploit in minutes]
    M --> G{Access to frontier model?}
    G -- No, blocked by Glasswing --> S[Manual triage, flat throughput]
    G -- Yes --> V[Model-assisted validation/fix]
    X --> U[Users exposed before patch]
    S --> U

What to do

The page prescribes no commands or patch. Its actionable claims for a maintainer/engineer:

• Treat any public signal — an open PR, an odd orphan-branch commit, a context leak, even a mailing-list question — as sufficient to trigger automated exploitation. Embargo-by-secrecy no longer protects users.
• The bottleneck is defender remediation throughput (validation, triage, release), not exploit generation. The cited framing ("bugonomics", Pesoli et al., 2026) argues effort should go to tool-verified, model-assisted workflows that find and fix defects before disclosure.
• Note the limit: Google-style microupdates that push fixes straight to endpoints aren't available to projects (OCaml, Docker) that don't control deployment endpoints; downstream distros repackage on their own timelines.

Caveats

This is a single maintainer's incident report plus opinion, not a controlled study. The -7-day and 63-day figures and the 10-minute/1-minute observations are his own or loosely sourced ("a quick search finds"). The Fang et al. benchmark is 15 vulnerabilities — small. Several product and model names (Fable, Glasswing, DeepSeek V4 Pro, Mythos) appear without further sourcing on the page.