So, how bad is the security risk? The study found that even if an attacker had no control routers, 80 percent of Tor users could be de-anonymized within six months. With control of one AS, nearly 100 percent of users were likely to be uncovered, within three months. With two, it could take just one day.
Given all of the tidbits passed along in this post, it seems to make logical sense to assume that the NSA could de-anonymize any Tor user within a day or so. This is both impressive, and immensely concerning.