In a post highlighted by Simon Willison on 28th August 2026, Anil Madhavapeddy, a professor of computer science at Cambridge and a core maintainer of the OCaml compiler, reported that security issues in OCaml projects are seeing attempted exploits within minutes of patches being shared for discussion. According to the post, within about ten minutes of a patch being shared, a website was fielding probes for percent-encoded traversal sequences, which he described as evidence that automated watchers are monitoring public repositories. Madhavapeddy said modern coding agents have become effective enough that the slightest hint of a new bug can be enough for them to find it, something he demonstrated using his own agents, switching to DeepSeek V4 Pro when Claude Fable refused the task. He argues this rate of discovery appears incompatible with existing open source embargo practices. In the Hacker News comments, rclone maintainer Nick Craig-Wood confirmed a similar experience, stating that his project received about 20 security disclosures via GitHub in its first 10 years but more than 40 in the last month, with roughly 75% containing something worth investigating. He added that GitHub CVE assignments, previously taking 2-3 days, are now running at 3-4 weeks, forcing point releases labelled CVE-PENDING.
- OCaml maintainer reported exploit probes within about ten minutes of a patch being shared
- rclone received over 40 security disclosures in one month versus about 20 in its first 10 years
- Roughly 75% of rclone's recent disclosures contained a genuine issue
- GitHub CVE assignment times reportedly rose from 2-3 days to 3-4 weeks
- Reported by Simon Willison on 28th August 2026
What it means for you
AI coding tools are now good enough that even a hint about a software flaw can be turned into a working attack within minutes of it appearing in public. For most people this is background weather, not a personal alarm. But if you or your business runs open source software, the old assumption that you have days to patch quietly after a bug is discussed no longer holds.
Try this
If you run any self-hosted or open source software, turn on automatic security updates where you can, and make sure you're subscribed to security advisories for the tools you depend on so patches land fast rather than sitting for weeks.
Who should care
Maintainers of open source projects, developers, and anyone running self-managed software or servers rather than fully managed cloud services.
Skip this if
You only use managed software and cloud apps (Google Workspace, Microsoft 365, hosted SaaS) where the vendor handles patching for you.
Sources: Simon Willison — read the original