Just a rumour of a bug is enough to find a security exploit these days

Public discussion of a security fix can give attackers useful information before users receive an update. Simon Willison's write-up points to an OCaml web-library maintainer who reported suspicious requests roughly ten minutes after opening a public patch for review.

In the maintainer's account, he also used an agent to reproduce an exploit locally from a broad description of the problem. That illustrates why shortening the path from a verified fix to a released update matters: public clues can become actionable quickly. His local experiment does not establish that AI generated the external requests he observed.