# AIs Compress Exploit Timeline

> Source: <https://www.schneier.com/blog/archives/2026/09/ais-compress-exploit-timeline.html>
> Published: 2026-09-10 10:40:35+00:00

Give an AI agent a mere [rumor](https://anil.recoil.org/notes/rumour-is-the-exploit) of an exploit, and it’s enough for them to find it.

What’s worse, I found I could use my own agents to find the exploit *just by knowing roughly what it was about* and so could have been exploiting it well before the public patch was available! Given that just the *rumour* of a security issue seems enough to give attackers enough info to find new exploits, we’re going to need to change the way we deal with security responses in open source.

Simon Willison [comments](https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/):

Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe...