Simon Willison reports on a newly emergent phenomenon: AI agents can now discover working security exploits from nothing more than a vague public hint that a vulnerability exists — before a formal CVE or patch is issued. The embargo window that maintainers have historically relied on to coordinate fixes is collapsing, because agents can autonomously scan, fuzz, and probe a codebase at a speed and scale no human attacker could match in the same timeframe.
This has direct structural implications for open source maintainers and the humans-and-agents workflows they depend on. The attack surface is no longer the disclosed vulnerability — it is the signal that a vulnerability exists. Agentic systems operating in background-execution mode, with broad read and network permissions, can act on that signal before any human in the responsible-disclosure chain has finished their coffee.
For designers and builders of agentic developer tooling, this is a forcing function to revisit permissions scoping, observability, and approval gates. The question is no longer only what an agent is authorised to do — it is what an agent can infer and act on from ambient signals, and whether any human is in a position to interrupt or review that chain before damage is done.