AI Is Breaking Both Vulnerability Cultures

In open source ecosystems like the Linux kernel, there exists a practice called Embargo, where security vulnerabilities are shared privately, then fixes are distributed publicly, attempting to hide the actual existence of the vulnerability for a few days. However, as seen in the recent Copy Fail case, this approach is running into situations where the embargo is broken due to external discovery.

The rise of AI is fundamentally changing this security culture. As AI dramatically lowers the cost of evaluating the security implications of each commit, it has become much easier to find vulnerabilities in quietly published fixes.

Both existing security cultures are under pressure from AI.

• Coordinated Disclosure: This typically uses a grace period of about 90 days to encourage fixes to be distributed first, but this period is becoming meaningless as AI-assisted tools scan software at scale.
• "A Bug Is a Bug" Culture: This approach fixes issues quickly without emphasizing that they are security issues, but as AI becomes better at picking up security-related signals within commits, the risk of unintentionally exposing vulnerabilities has grown.

Indeed, it has been confirmed that when specific commits (diffs) are fed into major LLM models such as Gemini, ChatGPT, and Claude, the models are able to identify them as security patches. This suggests that AI has become a powerful tool for both attackers and defenders, and that very short embargoes may become the standard going forward.