AI Shrinks the Path from Vulnerability Rumor to Working Exploit

On his blog, Bruce Schneier raises a troubling subject: artificial intelligence is radically shrinking the time between the first rumors of a vulnerability and the creation of a working exploit.

A Hint Is Enough

According to the researcher, an AI agent doesn't need the details — the mere fact that a problem exists somewhere is enough. Given only a general sense of what's at issue, the agent is able to find the vulnerability itself. Schneier describes his own experience: with the help of his agents, he managed to track down an exploit knowing only the rough gist of the problem. Which means that, in theory, it could have been exploited long before a patch was released publicly.

The conclusion is bleak: if a single rumor that a flaw exists is enough for an attacker to reconstruct it and write an exploit, then the entire familiar order of responding to threats in open software needs to be rethought.

The Embargo Problem

Commenting on the post, Simon Willison relays an observation from Anil: this speed of discovery sits poorly with the current practice of embargoes on new vulnerabilities. The point of an embargo is to give a project's maintainers time to prepare and roll out a fix before the details become public. But if a problem turns into an exploit that quickly, the very idea of a quiet window before disclosure starts working against the defenders.

The result is a paradox: to protect the community, people try to say as little as possible about a flaw, and as late as possible — yet even fragmentary information is now enough for an AI to see the job through. That means new processes are needed, ones that account for attackers' increased speed and allow open source communities to stay safe.

The post offers no concrete recipes — it merely notes that the old rules of the game no longer match the new capabilities of the tools, and it invites the industry to think about a response.

Source: Schneier on Security