Someone dumped 20 zero-days on open source tools with no warning. The fuzzing was run by AI.

Short summary

An anonymous researcher published 20+ zero-day exploits for major open-source projects using AI-assisted fuzzing, sparking debate over responsible disclosure ethics. The AI identified potential bugs via automated analysis, but humans confirmed and hand-coded the actual exploits. The incident reveals AI's emerging role as a tireless security analyst, compressing weeks of auditing into automated loops.

• •20+ unpatched zero-days dropped for nmap, FFmpeg, Firefox, Docker, and other open-source tools without warning to maintainers
• •AI-assisted fuzzing identified candidates; humans confirmed and wrote exploit code, revealing a productive division of labor
• •Coordinated vs. full disclosure debate resurfaces: unpatched exploits risk users, but delayed patching may hide systemic vulnerabilities indefinitely

Generated with AI, which can make mistakes.