cohttp Path Traversal Bug: How an AI Agent Wrote an Exploit in Under a Minute
A patch pull request for a path traversal flaw in the OCaml HTTP library cohttp 6.3.0 drew scanning traffic within roughly ten minutes of going public. An AI agent, given only a vague description of the bug type, produced working exploit code in under a minute. The incident raises hard questions about whether traditional security embargo practices still hold up. What Happened A pull request fixing a path traversal vulnerability in cohttp 6.3.0, an HTTP client/server library for OCaml, was published on GitHub. Within about ten minutes, real servers started receiving probe requests matching the exact pattern described in that PR. Separately, a researcher gave an AI agent only a rough description of the vulnerability category — not the actual patch, not a detailed writeup — and the agent produced functioning exploit code in under one minute. No deep familiarity with the codebase or the diff was required. Background: Why Embargoes Used to Work The standard practice in vulnerability ...