📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The traditional 90-day window for vulnerability disclosure has ended without vendor notice. AI tools now enable attackers to exploit patches before they are widely deployed, shifting the security landscape.
The 90-day window for responsible vulnerability disclosure has officially closed without any notice from affected vendors, marking a significant shift in cybersecurity dynamics. This development underscores the growing influence of AI in security research, enabling attackers to identify and exploit vulnerabilities faster than ever before, often before patches are publicly available.
Traditionally, the 90-day coordinated disclosure window, established by Google Project Zero in 2014, provided a period during which vendors could develop and deploy patches after a researcher reported a vulnerability. Once the window closed, the researcher was free to disclose details publicly, balancing the interests of security researchers and vendors.
However, recent advances in AI-driven vulnerability discovery, exemplified by tools like Theori’s Xint Code, have drastically shortened the time needed to analyze patches and develop exploits. In the case of the Linux kernel’s Copy Fail vulnerability, a patch was committed on April 1, 2026, and publicly disclosed on April 29. During this period, AI systems could monitor commits, identify security fixes, and generate working exploits within minutes—much faster than human analysts could.
Moreover, the collapse of the knowledge floor—meaning the decline of the expertise barrier for finding vulnerabilities—has expanded the attacker base to include those without formal security training. AI prompts can now surface zero-days in complex software, making previously inaccessible vulnerabilities exploitable by a broader range of malicious actors.
Recent high-profile breaches, such as those at Vercel and Canvas, reveal that the most significant vulnerabilities in 2026 are no longer memory safety bugs but trust boundary failures at integration points like OAuth scopes and third-party permissions. These areas lack mature defensive tools and are more susceptible to AI-driven discovery, further eroding traditional security assumptions.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Generative AI-Powered Assistant for Developers: Accelerate software development with Amazon Q Developer
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
![Express Rip Free CD Ripper Software - Extract Audio in Perfect Digital Quality [PC Download]](https://m.media-amazon.com/images/I/41xx28xHa+L._SL500_.jpg)
Express Rip Free CD Ripper Software – Extract Audio in Perfect Digital Quality [PC Download]
Perfect quality CD digital audio extraction (ripping)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
NetAlly CyberScope Air Wi-Fi Edge Network Vulnerability Scanner (Wireless Only Version). Validate Edge Infrastructure Hardening, Hunt Down Rogue Devices, Investigate Suspect RF Interference
Portable, handheld form factor – Take it anywhere for on-site security testing. This field-ready tool gives you visibility…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
zero-day exploit detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disrupted Disclosure Framework
The end of the 90-day disclosure window without notice signals a fundamental shift in cybersecurity risk management. Attackers can now discover, develop, and weaponize exploits in real-time, often before patches are widely deployed. This shift diminishes the defensive advantage previously held by vendors and security teams, emphasizing the need for new strategies to address AI-facilitated threats.
Additionally, the collapse of the knowledge barrier means more actors—ranging from script kiddies to sophisticated nation-states—can find and exploit vulnerabilities with minimal expertise, increasing the overall threat landscape. The focus is shifting from memory safety bugs to trust boundary issues, which are less protected by existing defensive measures.
Evolving Security Landscape and Past Practices
The responsible disclosure model has operated since the early 2000s, relying on a 90-day window to balance the interests of researchers and vendors. This approach depended on assumptions that reverse engineering a patch takes meaningful time, and that the patch itself signals the presence of a vulnerability.
With AI tools capable of analyzing patches and generating exploits within minutes, these assumptions no longer hold. The Linux kernel’s Copy Fail vulnerability exemplifies this shift: the patch was committed on April 1, 2026, and publicly disclosed on April 29, but AI-driven monitoring meant exploits could have been developed during that window.
Recent breaches at Vercel and Canvas demonstrate that the most impactful vulnerabilities are now at the integration and trust boundary levels, areas traditionally less protected and more susceptible to AI-driven discovery. This indicates a move away from the classic focus on memory safety towards complex system interactions.
“The 90-day window is no longer a defender’s advantage but an attacker’s window, thanks to AI-driven vulnerability analysis.”
— Thorsten Meyer
Unresolved Questions About Future Security Risks
It remains unclear how quickly vendors will adapt their security practices to this new reality, or whether new disclosure frameworks will emerge to replace the 90-day window. The long-term impact on software development cycles and patch deployment strategies is still being evaluated, and the full scope of attacker capabilities enabled by AI is not yet fully understood.
Next Steps for Security and Policy Adaptation
Security communities and organizations are expected to explore new models for vulnerability disclosure that account for AI’s rapid analysis capabilities. Vendors may need to implement real-time monitoring and automated patching systems, while policymakers could consider regulations to manage AI-driven security risks. Monitoring of AI tools and their influence on exploit development will be critical over the coming months.
Key Questions
What caused the end of the 90-day disclosure window?
Advances in AI-driven vulnerability discovery have enabled exploits to be developed and weaponized much faster than traditional methods, rendering the 90-day window ineffective and potentially harmful.
Why is this shift important for cybersecurity?
It means attackers can now act on vulnerabilities before patches are deployed, reducing the effectiveness of traditional defense strategies and increasing the urgency for new security approaches.
Are trust boundary vulnerabilities more dangerous now?
Yes, recent breaches indicate that vulnerabilities at trust boundaries—such as OAuth and SaaS integrations—are now the most critical, as they are less protected by existing defenses and more accessible to AI-enabled attackers.
What can organizations do to protect themselves?
Organizations should implement real-time monitoring, adopt automated patching where possible, and develop strategies to secure trust boundaries and third-party integrations against AI-facilitated exploits.
Will new disclosure policies replace the 90-day window?
It is uncertain. The cybersecurity community is actively discussing alternative frameworks, but no consensus or implementation has yet emerged to fully address AI-driven threat acceleration.
Source: ThorstenMeyerAI.com
