tl;dr: An OCaml cohttp maintainer observed automated exploit probes hitting his server within 10 minutes of opening a public PR for a path traversal fix, and found his own LLM agent could generate a working exploit in under a minute from just a vague description. He argues that traditional security embargoes are now obsolete since LLM agents can derive exploits from mere rumors of a bug, citing data showing mean time-to-exploit has gone negative. Proposed responses include private patch coordination via web-of-trust, continuous shipping with better cross-ecosystem packaging, and protocol-layer virtual patching akin to Cloudflare's managed rules.