Just a rumour of a bug is enough to find a security exploit these days

Simon Willison 8月28日转发 Anil Madhavapeddy（剑桥教授OCaml 编译器核心维护者）笔记：在 OCaml 项目的私人 patch 讨论刚发出十分钟，他自己的网站就开始被 percent-encoded traversal 探测，证明有自动 watcher 在盯着公开 repoAnil 用自己的 agent 复现了一遍Claude Fable 拒绝做的任务，DeepSeek V4 Pro 接了很快就能 exploitrclone 维护者 Nick Craig-Wood 在评论区给出具体数字：rclone 前十年通过 GitHub 收到的安全披露约 20 个，过去一个月收到 40 多个，其中约 75% 含真实可处理的问题，CVE 编号现在要等 3-4 周（AI 之前是 2-3 天）...

Just a rumour of a bug is enough to find a security exploit these days

ID: 20919fd9
原文链接: https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug
作者/平台: Simon Willison / blog
发布日期: 2026-08-28
归档分类: industry
标签: oss-security、disclosure、ai-exploit、cve、agent-tools
质量评分: 4/5
抓取时间: 2026-09-01T23:30+08:00

中文导读

为什么值得关注

AI 把私下 patch 等几天再公开的 embargo 实践彻底打穿：自动 watcher 10 分钟内就探测，rclone 一个月收的安全披露比前十年还多

关键信息

文章标题：Just a rumour of a bug is enough to find a security exploit these days
作者/平台：Simon Willison / blog
原文链接：https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug
发布日期：2026-08-28
关联标签：oss-security、disclosure、ai-exploit、cve、agent-tools

English Summary

Simon Willison's 8/28 post on Anil Madhavapeddy's (Cambridge professor, OCaml compiler core maintainer) note: ten minutes after a private OCaml patch discussion went out, his own site was probed with percent-encoded traversal attacks proof that automated watchers are monitoring public repos. Anil reproduced this with his own agent: a task Claude Fable refused, DeepSeek V4 Pro picked up and exploited quickly. rclone maintainer Nick Craig-Wood commented with concrete numbers: ~20 security disclosures via GitHub in rclone's first decade, 40+ in the past month, ~75% containing real actionable issues. CVE numbers now take 3-4 weeks (vs 2-3 days pre-AI), forcing him to write 'CVE-PENDING' in the changelog....

Obsidian Notes

来源：2026-09-01 AK-RSS Digest（89源精选）/ 每日综合摘要 / 调研 / DeepResearch 视所属主题而定
内容由 opencli 拉取原始来源 + Obsidian 笔记交叉核对生成。
中文导读与价值判断均锚定原文摘要与作者；未补充原文章节之外的细节。
抓取时间戳：2026-09-01T23:30+08:00。