Claim
The mean time to exploit published software vulnerabilities crossed zero in 2024 and now sits at -7 days. AI coding agents need only a CVE description, not the actual patch, to generate a working exploit for 87% of tested vulnerabilities. The public disclosure process, designed to give defenders time, now serves as the signal that launches automated attacks.
Mechanism
Traditional vulnerability timelines assumed defenders could act after a patch shipped while attackers needed days or weeks to reverse-engineer the flaw. That assumption depended on attackers having to work from a patch diff, which is hard. A CVE description is much simpler to exploit: it names the bug class and the affected component. Research by Fang et al. (2023) showed a GPT-4 agent exploited 87% of a 15-vulnerability benchmark when given a CVE description. Without any description, success dropped to 7%. The description is now sufficient. Madhavapeddy demonstrated this directly: he opened a PR to fix a path traversal issue in OCaml's cohttp library, and within minutes, his live server was fielding automated probes for the exact attack pattern. He reproduced the exploit himself with an AI agent in under a minute, given only the general problem area. Automated monitors now watch public repositories for any signal about a new vulnerability, then run the exploit generation loop immediately.
Conditions
Holds when: vulnerabilities are discussed publicly before patches are deployed (standard open-source coordinated disclosure). Holds most strongly when the bug class is well-documented (path traversal, injection, container escape, authentication bypass) because AI agents can pattern-match against known exploit templates.
Fails when: coordinated disclosure is strict and private with simultaneous patch-and-disclose; the bug class is novel with no training-set examples; the affected system has no public API or live endpoint to probe.
Evidence
Fang et al. (2023) research: when given a CVE description, their GPT-4 agent exploited 87% of a 15-vulnerability benchmark; without the description, just 7%.
Mean time to exploit metric: Madhavapeddy reports it sat around 63 days in 2018-19, crossed zero in 2024, and now sits at -7 days.
Two recent real-world incidents:
- Marimo CVE-2026-39987: went from advisory to first exploitation attempt in 9 hours
- Langflow CVE-2026-33017: first exploitation attempt in 20 hours
On his own cohttp fix:
"Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories."
Nick Craig-Wood (rclone maintainer) corroborated: the project received 40+ security disclosures in one month, versus 20 over the prior ten years, with a 75% hit rate for actionable issues.
Signals
- Security disclosure threads attracting probing traffic within hours of publication in your server logs
- Open-source maintainers receiving floods of actionable CVE reports in a short window
- The gap between patch PR creation and first observed exploitation attempt narrowing to single-digit hours
Counter-evidence
The Fang et al. research used GPT-4 on a curated 15-vulnerability benchmark; generalizability to arbitrary real-world bugs is unproven. Proprietary software with private coordinated disclosure keeps the patch-to-exploit timeline positive. The -7-day mean time to exploit applies specifically to open-source projects with public patch discussions. Nick Craig-Wood's 75% hit rate may reflect improved researcher quality as much as AI capability.
Cross-references
- ins_willison-machine-speed-offense (AI attackers win through machine-speed iteration on known vulnerability classes; the July 2026 Hugging Face intrusion compressed 17,600 actions into five days)