AI is Exploiting Security Vulnerabilities at Unprecedented Speed
Security patches now arrive after attacks have already begun.
1Vulnerability Discovery and Rapid Exploitation
A path traversal vulnerability was discovered in OCaml's cohttp 6.3.0. Normally, such vulnerabilities would be fixed privately and users would be informed. However, this time, automated queries probing for the exact vulnerability appeared in server logs just minutes after the fix PR was opened. More concerning, even rumors of a security issue now provide enough information for attackers to develop exploits.
2AI-Powered Exploitation Tools
AI tools like Claude Fable can quickly identify security vulnerabilities. One user analyzed the affected code with DeepSeek V4 Pro and created a working exploit for a local server in under a minute. Research by Fang et al. shows that a GPT-4 based agent can generate exploit code for 87% of vulnerabilities when given a CVE description.
3Dramatic Shift in Exploitation Timelines
In 2018-2019, it took an average of 63 days to exploit a vulnerability. By 2024, this dropped to zero days. In 2026, the average is now -7 days, meaning patches arrive after attacks begin. Marimo's CVE-2026-39987 was exploited just 9 hours after advisory, while Langflow's CVE-2026-33017 took 20 hours. Automated exploit generation has clearly crossed a threshold.
4Inadequacy of Traditional Security Processes
Traditional security processes assume secrecy of vulnerability details protects users. But today, an AI agent only needs general direction to conduct its own research. This requires open source projects to rethink security responses. Even one person searching for an issue can alert another's AI agent to begin exploit development.
5Stagnant Maintenance Capacity
According to Pesoli et al's 2026 paper, while AI tools rapidly generate exploits, defense capacity isn't keeping pace. Open source maintainers' validation, prioritization and release rates remain flat. Small projects particularly struggle with access to frontier models, leaving vulnerabilities unpatched longer.
6Solutions from Large Companies
Major engineering teams like Google build micro-updates directly into software to ensure fixes reach users quickly. However, projects like Docker or OCaml don't control endpoints where their software runs. Beyond Docker Desktop, open source distributions repackage on their own schedules, delaying fixes.
7Access Challenges for Small Projects
Access to frontier models remains a significant barrier for small projects. Security guards on Western commercial models restrict availability. While Project Glasswing serves 150 organizations across 15 countries, individual maintainers still lack access. This results in vulnerabilities remaining unpatched longer and being exploited more frequently.
8Recommendations for the Future
Security processes must adapt to match the speed of AI-powered exploitation tools. Manual triage shouldn't disappear but needs augmentation with automated workflows. Reducing technical debt through semantics-grounded, tool-verified, model-assisted workflows could help maintainers find and fix security defects before they become tomorrow's exploited vulnerabilities.