AI Agents Are Disrupting Open Source Security Disclosure

rclone took about 20 security disclosures in its first ten years, and more than 40 in the last month alone, per creator Nick Craig-Wood. Worse: a path-traversal fix in the OCaml compiler drew probe attempts in live server logs minutes after the PR went up. QEMU has already shortened its embargoes. Fixing in public is now a disclosure channel, and most projects have no process for that.