AI models capable of scanning source code changes are dismantling established security disclosure practices, making long embargoes increasingly obsolete. In one recent case, two independent researchers reported the same ESP vulnerability just nine hours apart, illustrating how fast flaw detection has become. As AI lowers the cost of evaluating raw code diffs, both 90-day disclosure windows and silent open-source patching strategies are failing.
Two Security Cultures Under Pressure
Software security historically relied on two distinct workflows to manage vulnerabilities. Coordinated disclosure grants maintainers a 90-day window to fix flaws privately before public release, while the open-source "bugs are bugs" approach patches issues quietly in public repositories under the assumption that individual diffs blend into standard commit volume.
However, a security analysis published by developer Jeff Kaufman shows that AI automated scanning renders public commits far easier to detect. In a Linux networking incident involving the Copy Fail bug, researcher Hyunwoo Kim published a fix quietly in the open, but another observer quickly identified the security implications of the change, publicizing details and ending the embargo prematurely.
AI Commit Analysis Benchmarks
To demonstrate how accessible commit evaluation has become, Kaufman conducted a test feeding commit f4c50a403 to three AI models:
- Gemini 3.1 Pro: Positively identified raw diffs as a security patch without extra context.
- ChatGPT-Thinking 5.5: Marked the raw code diff as a probable security patch.
- Claude Opus 4.7: Evaluated the isolated diff as likely not a security patch, but correctly identified it when given full commit details.
- Parallel Discovery: Kuan-Ting Chen reported the ESP vulnerability just 9 hours after Kim, showing how overlap reduces embargo viability.
Impact on Security Teams and Limitations
These developments directly affect open-source maintainers, software vendors, and enterprise security operations. Because automated AI tools make scanning public diffs cheap and high-signal, organizations can no longer rely on code obscurity or multi-month embargoes to protect unpatched systems.
An honest caveat remains regarding current capabilities: Kaufman noted the test was a quick single-run evaluation without a formal control group, and cross-model performance varied on raw diffs alone. Additionally, defenders can leverage the same AI speed to accelerate internal patching cycles, potentially balancing the defensive timeline.
Why it matters
The era of relying on quiet public code commits or standard 90-day secrecy windows is rapidly ending. Security teams and open-source maintainers must shift toward significantly shorter embargo periods and adopt AI-driven defensive workflows to patch code as quickly as automated systems discover vulnerabilities.