Pre AI, silently publishing a fix to a security vulnerability was considered bad practice.

Post AI, Its efficiency pre announcing the exploit to bad actors until the official disclosure.

You can just watch the diff log of every open source project with a small local model, and look for anything that touches buffers, function pointers, or shell integration.

It could be an hour between release of a fix before the exploit starts attacking servers.

Guess what also could happen within an hour? A coordinated Internet wide panic that shuts down all vulnerable servers.

---

We actually have a recent example. OpenAI hack.

An undisclosed vulnerability fix to a image formal lib; packages into debian 12 running in a docker, used by imagemagic, used by discourse running OpenAIs user forum.