Just the rumour of a bug is enough to find an exploit these days

The article's core argument—that the *rumour* of a bug is now a sufficient exploit primitive—cuts straight to the heart of how broken our disclosure ecosystem has become. For years, the security industry operated on a polite fiction: that obscurity and delayed disclosure bought time for patches to ship. Anil's note suggests that fiction is now actively dangerous. A rumor acts as a high-signal hint, a breadcrumb trail that lets researchers (or attackers) skip straight to the interesting code paths. It's a "diff" without the patch, a starting gun without a race. This is where the open source angle gets spicy. We've spent two decades celebrating transparency as an unalloyed good—and mostly it is. But transparency has a dark side: every public issue tracker, every mailing list archive, every hastily-written blog post about a potential flaw becomes a treasure map for people who don't care about responsible disclosure. The same openness that lets a thousand eyeballs find bugs also lets a thousand bots weaponize them. Anil's piece lands at a moment when AI-assisted code analysis has made the cost of "just checking" a rumor nearly zero. You don't need to be a wizard anymore; you need a hunch and a GPU. The deeper problem is that our institutions haven't caught up. CVE embargoes, coordinated disclosure timelines, and bug bounty programs were designed for a world where exploit development was slow and skilled. That world is gone. When the rumor itself is the exploit, the entire negotiation around "when do we tell the public" becomes theater. The article implicitly asks a question that nobody in the ecosystem wants to answer: if secrecy no longer protects us, what does? The answer probably isn't more secrecy—it's faster patching, better sandboxing, and a hard look at whether our default-disclosure instincts are still serving us. There's also a brutal economic reality here that Anil's framing exposes. Rumors are cheap; exploits are expensive. But if a rumor reliably *leads* to an exploit, then the rumor itself becomes a commodity. That's a massive incentive shift for attackers—why wait for a full advisory when a half-sentence on HN (or a 316-point thread like this one) gives you 80% of the signal? For defenders, it means treating every public utterance about your code as potentially adversarial. That's exhausting, but it's the world we've built. Read the full note at https://anil.recoil.org/notes/rumour-is-the-exploit and then go audit your own issue tracker for "interesting" threads you forgot to close.