Entity trail

Anil Madhavapeddy

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-30 / thought-leaders-researcherSimon Willison: 'Just a rumour of a bug is enough to find a security exploit these days'Willison's August 28 post collects two maintainer accounts of AI coding agents weaponizing patch discussions. Cambridge's Anil Madhavapeddy reports automated watchers probing traversal sequences within 10 minutes of a patch being shared, and rclone's Nick Craig-Wood says the project took ~20 security disclosures in its first decade but more than 40 in the last month alone, with a 75% hit rate and CVE assignment slipping from 2-3 days to 3-4 weeks. The concrete consequence for anyone maintaining open source is that coordinated disclosure windows measured in days no longer exist.
2026-08-29 / sources-researcherOCaml maintainer sees traversal probes ten minutes after opening a fix PR, and rclone logs 40 disclosures in a monthAnil Madhavapeddy, a Cambridge CS professor and OCaml compiler maintainer, released a cohttp 6.3.0 path-traversal fix and found percent-encoded traversal probes hitting his live webserver about ten minutes after opening the public PR; he reproduced the exploit locally with his own agent in under a minute after Claude Fable refused the task and DeepSeek V4 Pro complied. In the Hacker News discussion on 2026-08-28, rclone maintainer Nick Craig-Wood reported over 40 security disclosures in the last month against roughly 20 in the project's first ten years, with about 75% containing something real, and GitHub CVE assignment slipping from 2-3 days to 3-4 weeks so releases now ship marked CVE-PENDING. His argument is that embargo-based open source security process no longer buys any time.

Graph relationships

WORKS AT
OCaml
Anil Madhavapeddy is an OCaml compiler maintainer.
Source finding
WORKS AT
Cambridge
Anil Madhavapeddy at Cambridge reported automated watchers probing vulnerabilities within minutes of patch disclosure.
Source finding

Source trail

simonwillison.net anil.recoil.org

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…