Topic
Attacker use of AI-generated exploit scripts against critical infrastructure targets.
Princeton's Max Springer says a publicly available AI assistant unshuffled Georgia's May primary ballot records and then told him which public files it needed to attach names to them. The flaw was documented in 2022.
Reality
Anil Madhavapeddy's account of the cohttp 6.3.0 path traversal fix puts a number on the gap between publishing a patch and being probed for the bug it closes. The three alternatives he examined each cost a small maintainer something.
Reality
Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.
Reality
An SC Media commentary builds its case from Verizon's 2026 breach data, JPMorgan's patch arithmetic and Endor Labs dependency counts. Every figure reaches operators secondhand, and the ratio of disclosed to patched is the one that survives the discount.
Reality
Microsoft patched the Exchange authentication bypass on August 11. Shadowserver's September 1 scan still counts 21,899 internet-facing servers unpatched, and NCSC-NL says working exploit code for full mailbox takeover is circulating.
Perspective Coverage
3 publishersReality
The count federal agencies had not published arrives attached to a remediation list that begins with taking inventory, which says more about this campaign than the attribution does.
Reality
House Democrats want the watchdog to measure what the loss of nearly 1,000 CISA staff did to the mission. The fiscal 2027 request would remove about 900 more, and GAO has not yet agreed to take the job.
Reality