DeepSeek V4 Pro finds exploits from mere rumors of bugs

Open-source maintainers are warning that the rise of advanced AI coding agents has dramatically accelerated the timeline for software exploit discovery. Anil Madhavapeddy, a computer science professor at Cambridge and core maintainer of the OCaml compiler, reported that automated watchers are monitoring public repositories and probing for vulnerabilities within ten minutes of patches being shared for discussion. In one instance, a website was immediately hit with probes for percent-encoded traversal sequences.

Madhavapeddy demonstrated this rapid discovery capability using his own AI agents. When the Claude Fable model refused to perform the task of finding the vulnerability, he successfully switched to DeepSeek V4 Pro to locate the flaw. This indicates that even the slightest hint of a new bug provides enough information for modern AI models to generate a working exploit almost instantly.

This surge in AI-driven vulnerability scanning is overwhelming open-source projects. Nick Craig-Wood, the maintainer of rclone, confirmed that his project received only about 20 security disclosures through GitHub during its first 10 years. In contrast, rclone had to deal with over 40 disclosures in the last month alone. Craig-Wood noted that about 75 percent of these automated submissions contain a legitimate issue that requires attention, forcing him to spend massive amounts of time triaging them.

The sheer volume of AI-generated security reports has also crippled the broader vulnerability disclosure pipeline. Before this influx, GitHub typically took two to three days to assign Common Vulnerabilities and Exposures (CVE) identifiers. Now, the process takes three to four weeks, forcing maintainers to release point updates with a "CVE-PENDING" status in their changelogs. These developments suggest that traditional open-source embargo practices are no longer sufficient to keep communities safe.