AI bug-hunting is compressing the patch window

An HN user posted 'I unknowingly broke the PHP RCE embargo,' and the thread's real news was that the bug was already being exploited in the wild, with an AWS threat intelligence post cited as evidence. The 'Is this the new cyber normal?' thread ties it together. One commenter says we are in a brief transition where a scalable superhuman developer discovers a heap of bugs. Another says security experts they know 'freaked out' when Mythos was announced and that this is the new normal.

The pattern: embargoes were built for a world where finding a serious bug took weeks of human work. When discovery is cheap, secrecy decays fast and attackers get the same tools as defenders. The other side of the coin is the thread on LLMs making formal verification feasible at scale, where agents write the proofs. But commenters poke at the hard part: the spec has to model reality, or you've proven the wrong thing.

The disagreement is whether this is a transition spike or a permanent state. Optimists expect the bug pile to shrink once the backlog is cleared.