28 August 2026

AI agents exploit security patches within minutes of disclosure

• Automated AI tools are discovering vulnerabilities in open source software faster than maintainers can deploy fixes, sometimes within minutes of patch details becoming public.
• The rclone file-sync tool saw security disclosures jump from 20 over a decade to over 40 in one month, suggesting attackers are using AI to scan for newly-patched flaws.
• Open source project maintainers argue current security practices, which give developers time to patch before vulnerabilities go public, no longer work when AI can reverse-engineer fixes.

How it was covered

Simon WillisonDaily notes and links

Cambridge computer scientist Anil Madhavapeddy reports that security vulnerabilities in OCaml projects are being exploited within minutes of patches being discussed publicly, with automated watchers and AI coding agents becoming so effective they can discover flaws from minimal hints. The rclone project maintainer confirms this trend, reporting a surge from 20 security disclosures in ten years to over 40 in the last month, arguing that current open source embargo practices are incompatible with this acceleration and new processes are needed to protect communities.