A week ago the

Copy Fail

vulnerability came out, and Hyunwoo Kim immediately realized that the

fixes were insufficient, sharing a patch the

same

day. In doing this he followed standard procedure for Linux,

especially within networking: share the security impact with a closed

list of Linux security engineers, while fixing the bug quietly and

efficiently in the open. His goal was that with only the raw fix

public, the knowledge that a serious vulnerability existed

could be "embargoed": the people in a position to address it know, but

they've agreed not to say anything for a few days.

Someone else noticed

the change, however, realized the security implications, and shared

it publicly. Since it was now out, the embargo was deemed over,

and we can now see the full

details.

It's interesting to see the tension here between two different

approaches to vulnerabilities, and think about how this is likely to

change with AI acceleration.

On one side you have "coordinated disclosure" culture. This is

probably the most common approach in computer security. When you

discover a security bug you tell the maintainers privately and give

them some amount of time (often 90d) [...]

---

May 8th, 2026

https://www.lesswrong.com/posts/wKzWGMoubHoHRC4ng/ai-is-breaking-two-vulnerability-cultures