Three new cards from three operators. One measures how fast AI has collapsed the window between a patch announcement and the first exploit attempt. One adds a prioritization layer to earlier AI search citation research. One documents how a free demo feeds a discovery algorithm that dwarfs social media.
The patch announcement is now the attack signal
Anil Madhavapeddy published his analysis on August 22. He had opened a pull request to fix a path traversal issue in OCaml's cohttp library. Within ten minutes, his live server was fielding probes for the exact attack pattern. He was not surprised by the eventual probes. He was surprised by how fast they arrived.
"Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories."
The data behind the observation is not new; the application to open-source disclosure is. Fang et al. (2023) showed a GPT-4 agent exploited 87% of a 15-vulnerability benchmark when given a CVE description, but only 7% without it. The description alone is sufficient. Marimo CVE-2026-39987 went advisory to first probe in 9 hours; Langflow CVE-2026-33017 in 20 hours. Mean time to exploit, which sat around 63 days in 2018-19, crossed zero in 2024 and now sits at -7 days. Nick Craig-Wood (rclone maintainer) noted his project received 40+ actionable security disclosures in one month, versus 20 over ten prior years.
The implication is structural: coordinated disclosure was designed to give defenders a head start after patching. It now triggers the attack. AI agents generate working exploits from CVE descriptions alone, making the patch announcement itself the attack trigger.
- Anil Madhavapeddy, AI agents generate working exploits from CVE descriptions alone, making the patch announcement itself the attack trigger. AI agents exploit vulnerabilities from CVE descriptions alone; mean time to exploit crossed zero in 2024 and now sits at -7 days.
Knowing that third-party citations dominate is not enough
Aleyda Solis published her August 20 framework as a direct follow-on to her earlier finding that external domains account for 69-82% of AI search citations. That finding tells marketers where the citations come from. It does not tell them where to spend their budget.
The new framework adds six evaluative criteria: citation influence, brand association potential, marketing alignment, business value, durability under platform change, and expected effort. The core problem Solis names:
"Which third-party citations and platforms are actually worth investing in when the sources used by AI search platforms can change by vertical, prompt, market, platform and model release?"
Investing in Reddit presence makes sense for a SaaS brand in a vertical where peer experience drives citations. It makes less sense for a finance brand where news and review sources dominate. An activity that scores high on citation influence but low on business value is deprioritized in favor of one that scores high on both. The durability criterion filters out platform-specific tactics that lose value when AI models update. Six criteria for deciding which third-party platforms are worth investing in for AI search citations.
- Aleyda Solis, Six criteria for deciding which third-party platforms are worth investing in for AI search citations. A six-criterion framework scores third-party citation activities on citation influence, brand association, marketing alignment, business value, durability under platform change, and expected effort.
The Steam discovery algorithm beats social media 48 to 1
Chris Zukowski published the third installment of his golden age series on August 21, analyzing the launch of "How Many Dudes?" (7-person team, 1-year development). The game's demo spent at least 24 days on Steam's front-page New & Trending Free widget. That one surface generated 36,946 wishlists. YouTube Shorts campaigns for the same game generated 769 wishlists.
"The wishlists that come from the Steam algorithm like New & Trending Free, The Discovery Queue will dwarf anything you can do with social media."
The mechanism is discovery intent. Players browsing Steam are ready to wishlist. Viewers watching YouTube Shorts are not. A demo gives the game access to the widget layer that most indie developers spend their time trying to replace with social media. The game launched with 308K wishlists and sold 242,000 units. The demo's median playtime was 2 hours 2 minutes, which is the resonance signal that earned the widget placement. A free demo gives a game access to Steam's discovery widgets, which generated 48 times more wishlists than YouTube Shorts.
- Chris Zukowski, A free demo gives a game access to Steam's discovery widgets, which generated 48 times more wishlists than YouTube Shorts. A free demo gives a game access to Steam's New & Trending Free widget, which generated 36,946 wishlists versus 769 from YouTube Shorts for the same title.