Researchers Debate Coordinated Disclosure in LLM Age

On April 28, 2026 Greg Dahlman posted to the oss-sec mailing list arguing that the "maximum acceptable embargo period" for vulnerabilities disclosed to those lists should be 14 days, per reporting by Lets Data Science and the oss-sec archive on seclists.org. Dahlman also quoted vendor security documentation, including Cursor's description that an agent can read files without confirmation, as cited in the Lets Data Science coverage. Multiple participants on the thread - including Jeremy Stanley, Jacob Bachmeyer, Demi Marie Obenour, Willy Tarreau, and Tim Shephard - contributed examples and operational perspectives on disclosure, as recorded in the seclists.org archive.

Editorial analysis - technical context: Public posts on the thread emphasize that modern large language models (LLMs) materially lower the cost and time to surface patterns, code idioms, and configuration mistakes that previously required specialist knowledge or long-term persistence to find. Lets Data Science notes a concrete comparison in the thread between running Qwen3.6-35B-A3B on consumer hardware versus the token-costs companies incur when running large models behind a provider API. The thread also contains a vendor quote about an agent behavior: "Right now, the agent can read files without confirmation. That's the current behavior by design, and it's described in the security docs," per the Lets Data Science summary of the Cursor documentation.

Editorial analysis: Participants framed the LLM effect as broad and structural. Tim Shephard wrote that the arrival of LLM-assisted discovery makes many long-lived legacy vulnerabilities easier to find and described the situation as "a generational security event," per his May 11 post archived on seclists.org. Other contributors argued that embargoes can work against users when discovery speed increases, leading some maintainers to remove unnecessary details from commits or to consider different release practices, per Demi Marie Obenour and Willy Tarreau on seclists.org. The thread therefore links three practical pressures: shorter feasible embargo windows, a larger pool of potential adversaries using LLMs, and a longer inventory of legacy issues now within reach.

Editorial analysis: The posts also illustrate conflicting operational levers. Several contributors advocated for pragmatic use of LLMs in defensive workflows, while simultaneously warning that public disclosure timelines intersect with vendor model-training and telemetry practices. That tension underpins Dahlman's proposal of 14 days as a compromise interval on disclosure lists, a concrete number that participants invoked to compare against typical vendor training and response cycles.

• •Adoption of shorter disclosure windows or new community norms on oss-sec and related lists, including whether projects formally discuss a 14-day guideline.
• •Increased use of LLM-assisted scanning and code-review by maintainers, and community efforts to share automated detection rules that preempt rediscovery.
• •Vendor policy updates about data collection and training opt-outs for non-enterprise users, and whether those policies are cited in future coordinated-disclosure debates.
• •Evidence of exploit-chaining that leverages rediscovered legacy issues at scale, which maintainers and downstream projects may flag in advisories.

Editorial analysis: For practitioners, the thread is an early signal that disclosure processes and defensive tooling will need to adapt to faster rediscovery dynamics, and that community coordination and automated hardening may become more central to managing risk.