📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The traditional 90-day window for responsible vulnerability disclosure has expired without any entity issuing a notice. Experts warn this shift favors attackers, as AI tools can now exploit bugs faster than defenders can patch them.
The 90-day window for responsible vulnerability disclosure has officially closed without any organization issuing a notice, marking a significant shift in cybersecurity practices and raising concerns among experts about increased attacker advantages.
Traditionally, the 90-day coordinated disclosure window, established by initiatives like Google Project Zero in 2014, provided a structured period during which vendors could patch vulnerabilities before researchers disclosed them publicly. This framework aimed to balance the interests of researchers and vendors, giving defenders time to respond while preventing attackers from exploiting unpatched bugs.
However, recent developments in AI-driven vulnerability discovery have disrupted this model. In April 2026, a critical Linux kernel bug known as Copy Fail was patched on April 1. Within four weeks, researchers from Theori publicly disclosed the patch on April 29, but during that period, AI tools monitoring kernel commits could have reconstructed and weaponized the bug in minutes, not days. This rapid exploit development means the traditional 90-day window no longer confers a defender’s advantage.
Moreover, the collapse of the knowledge floor—where sophisticated reverse engineering was once necessary—has shifted the landscape. AI systems can now surface zero-days with minimal expertise, making the barrier to attack significantly lower. Recent breaches at Vercel and Canvas/Instructure demonstrate that the most impactful vulnerabilities in 2026 are no longer memory-safety bugs but trust-boundary failures, such as OAuth scope misconfigurations and third-party app permissions, at the integration level.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Vulnerability Management in Companies: Recognizing, assessing and eliminating vulnerabilities – with checklists, best practices and tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Mastering Python Networking: Utilize Python packages and frameworks for network automation, monitoring, cloud, and management
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Artificial Intelligence for Cybersecurity: How AI Detects Cyber Threats, Prevents Hacking, and Protects Your Data, Identity, and Smart Devices (AI Cybersecurity Mastery Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Secure Coding in Practice : Avoid Vulnerabilities and Write Safer Code
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
The end of the 90-day disclosure window fundamentally alters cybersecurity risk management. With AI tools enabling near-instantaneous exploitation, defenders lose the crucial lead time they once relied on to deploy patches and mitigate damage. This shift increases the urgency for organizations to rethink their security strategies, especially around third-party integrations and trust boundaries, which are now prime targets.
Additionally, the collapse of the knowledge floor means that even organizations without deep security expertise are vulnerable to discovering and exploiting bugs. The traditional apprenticeship and reverse engineering processes are no longer barriers for malicious actors, leading to a broader and more diverse attacker base.
Evolution of Vulnerability Disclosure and Attack Techniques
Since the early 2000s, the responsible disclosure model aimed to protect users by giving vendors a fixed period—initially 90 days—to patch vulnerabilities before they became public knowledge. Google Project Zero popularized this approach in 2014, creating a structured, predictable window that balanced disclosure with defense.
Recent advances in AI, exemplified by tools like Theori’s Xint Code, have drastically shortened the time needed to discover, analyze, and exploit vulnerabilities. The Linux kernel’s Copy Fail bug, patched in April 2026, exemplifies this shift: AI systems could reconstruct exploits days or minutes after a patch, eroding the original purpose of the 90-day window. The Vercel and Canvas breaches further illustrate that modern vulnerabilities often stem from trust boundary failures at the application layer, bypassing traditional memory-safety defenses.
“Our recent breach highlights how trust boundary failures are now the primary attack vector, emphasizing the need for better security at the integration level.”
— Vercel security team spokesperson
Remaining Questions About Future Vulnerability Management
It remains unclear how organizations will adapt their security practices to address the rapid exploitability enabled by AI tools. The long-term effectiveness of existing patching and monitoring strategies in this new environment is still uncertain, and whether new frameworks will emerge to replace or supplement the 90-day window is yet to be determined.
Next Steps for Cybersecurity Defense Strategies
Organizations are expected to accelerate adoption of real-time monitoring and AI-driven threat detection. Industry leaders will likely reevaluate vulnerability disclosure practices, possibly moving toward continuous or zero-day patching models. Further research and policy development are anticipated to address the new threat landscape, emphasizing proactive security measures at the integration and trust boundary levels.
Key Questions
What caused the end of the 90-day disclosure window?
Advances in AI-driven vulnerability discovery enable exploits to be reconstructed and weaponized in minutes, rendering the traditional 90-day window ineffective for defenders.
What vulnerabilities are now most concerning?
Trust boundary failures, such as OAuth scope misconfigurations and third-party app permissions, are now the primary focus, rather than memory-safety bugs.
How should organizations respond to these changes?
Organizations should adopt continuous monitoring, real-time patching, and strengthen security at the application and trust boundary levels to mitigate rapid exploit risks.
Is the responsible disclosure model still effective?
Its effectiveness is now limited, as AI tools shorten the window for exploitation, prompting calls for new disclosure and patching frameworks.
Source: ThorstenMeyerAI.com
