self.md radar — 2026-08-29
A maintainer opened a public fix for a path-traversal bug. Ten minutes later, their server was receiving probes shaped exactly like the flaw. This is one story, not three: the disclosure clock, the patch path, and the people who still have to decide whether a fix is safe have stopped moving at the same speed.
1. the public PR had a ten-minute head start
OCaml maintainer Anil Madhavapeddy fixed a path-traversal issue in cohttp 6.3.0, then opened the patch PR publicly to get review. Within roughly ten minutes, his webserver saw probes using percent-encoded traversal sequences. The release process had barely begun; somebody, or something, had already inferred the bug class.
The unnerving part is that the patch itself was not a public exploit tutorial. Madhavapeddy says he could reproduce an exploit against a local server in under a minute after pointing agents at the broad class of path-normalisation problem. The useful unit of leakage is no longer a finished proof of concept. It can be a stray branch, a discussion thread, or an oddly specific sentence in an issue.
That changes what “responsible disclosure” has to protect. A public discussion still buys review. It no longer reliably buys time.
reading: Madhavapeddy’s incident account · the cohttp security advisory · the patch PR
2. the exploit clock has slipped behind the patch clock
The cohttp incident is not proof of a universal new law. It is a nasty, concrete warning with company. Madhavapeddy cites a 15-vulnerability experiment where an agent given a CVE description exploited 87% of the benchmark; with no description, it managed 7%. He also points to recent reports of exploitation attempts nine hours after a marimo advisory and twenty hours after a Langflow disclosure.
The old process assumed a maintainer could coordinate a private fix, notify downstream users, then publish. That workflow was already fragile because it relied on unpaid people finding time for validation, release work, and frightened email. Now the attacker can use the same code-reading machinery to turn a partial clue into a working probe while the defender is still checking whether the patch breaks Windows or an old dependency.
This is not a case for hiding every defect forever. It is a case for admitting that disclosure, remediation, and release are now different clocks. Treating them as one calendar invitation is how an open-source project gets ambushed by its own review process.
reading: the original agent-exploitation study · Sysdig’s marimo case · VulnCheck’s 2026 exploitation report
3. the scarce resource is a checked fix
Madhavapeddy’s proposed responses are not very glamorous: temporary private forks, narrower access to patch work, continuous delivery of small fixes, and protection at the protocol layer while a durable repair is being reviewed. Every option has a cost. Private work excludes contributors; continuous shipping needs test and release capacity; network mitigations do not repair the source tree.
Still, the distinction matters. Agents can make bug hunting cheap and reports abundant. They do not make a regression-free patch, a compatibility decision, or a responsible release appear by magic. The bottleneck has shifted toward defender remediation throughput, the phrase explored in the recent “bugonomics” paper .
For a personal or small-team system, the boring implication is useful: keep the update path short, know which dependency is exposed, and leave enough evidence that a human can approve a change under pressure. A clever agent with no way to ship a checked repair is mostly an alarm that learned to shout faster.
reading: GitHub’s temporary-private-fork guidance · Google on faster Chrome security updates · the bugonomics paper
more to read
- Simon Willison’s note on the incident — a concise second account, including the maintainer-side cost of an AI-shaped disclosure queue.
- Langflow’s twenty-hour exploitation case — another reminder that public proof-of-concept code is no longer the only starting gun.
- Cloudflare’s Log4j response — not a current AI story, but a useful picture of what protocol-level mitigation can buy while patches move.
left on the table
- The AGENTS.md study is worth reading, but it collides directly with the August 15 Radar on skill files as execution surfaces; a fresh critique is not enough to reopen that slot.
- Puppetflow is a plausible browser-automation tool, but its Show HN launch is too thin to outrank a security process that is visibly failing in public.
- K-Dense’s scientific-agent skills have traction, but yesterday already led with research-agent evaluation; a skills directory would only blur the boundary the benchmark made useful.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- Best Claude Code plugins — choose the Claude-specific extensions worth installing, and the ones to skip
- Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup