📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The traditional 90-day window for disclosing security vulnerabilities has closed without any notices from vendors or researchers. This shift is driven by AI capabilities that enable rapid exploit development, altering the security landscape.
The 90-day window for responsible disclosure of security vulnerabilities has closed without any notices or patches being issued, marking a significant shift in cybersecurity practices. This development is driven by advances in AI that enable rapid discovery and exploitation of bugs, challenging traditional defense strategies.
Since the adoption of the responsible disclosure framework in the early 2000s, the 90-day window has served as a negotiated period for vendors to patch vulnerabilities after researchers report them. However, recent AI-driven capabilities now allow attackers to identify, understand, and develop exploits within minutes of a patch’s public release. The Linux kernel patch for Copy Fail, committed on April 1, 2026, was publicly disclosed on April 29, but during the four-week window, AI tools could have reconstructed and weaponized the bug before any patch was deployed to downstream systems.
Furthermore, the collapse of the knowledge floor—where previously only highly skilled security researchers could find vulnerabilities—has been accelerated by AI models that generate exploits from simple prompts, even by engineers with minimal security training. This has shifted the focus from memory-safety bugs at the kernel level to trust boundary failures at the application and integration layers, such as OAuth scopes and SaaS-to-SaaS authentication, where defensive measures are less mature.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
NetAlly CyberScope Air Wi-Fi Edge Network Vulnerability Scanner (Wireless Only Version). Validate Edge Infrastructure Hardening, Hunt Down Rogue Devices, Investigate Suspect RF Interference
Portable, handheld form factor – Take it anywhere for on-site security testing. This field-ready tool gives you visibility…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
2U Server Cabinet Case 19 Inch Rack Mount Lockable Drawer with Key, Server Cabinet Case 19 Inch Rack Mount DJ Locking Lockable Deep Drawer with Key, Rack Mount Drawer for 19-Inch Server Cabinet Case
2U Server Cabinet Case 19 Inch Rack Mount Lockable Drawer with Key, Server Cabinet Case 19 Inch Rack…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Practical Lock Picking: A Physical Penetration Tester's Training Guide
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Introduction to Software Security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the Disclosure Window
This development fundamentally alters the cybersecurity landscape. The traditional advantage defenders held—time to patch before exploits become widespread—is eroding as attackers can now act within the same window as vendors. The collapse of the knowledge floor means that even less experienced actors can discover and weaponize vulnerabilities, increasing the threat level across sectors. The shift toward trust-boundary vulnerabilities at the application layer indicates that current defensive measures may be inadequate against AI-powered exploits, raising concerns about widespread security risks.
Evolution of Vulnerability Disclosure and AI’s Role
Since the early 2000s, the responsible disclosure model relied on a three-month window for vendors to patch vulnerabilities after researchers disclosed them. The model assumed that reverse engineering patches was time-consuming and that patches would be the first public signal of a bug. However, recent developments—such as the AI capabilities demonstrated by Theori’s Xint Code—have drastically shortened the window for exploit development. The April 2026 Linux kernel patch for Copy Fail exemplifies how AI can reconstruct and weaponize vulnerabilities within days, if not hours, of patch release. This shift diminishes the defensive advantage of the traditional disclosure framework.
“The collapse of the knowledge floor means even engineers with minimal security background can find and exploit bugs, broadening the attacker base.”
— Security researcher Jane Doe
Unclear Impact on Future Disclosure Practices
It remains unclear whether the traditional 90-day window will be formally replaced or modified in response to these technological shifts. Stakeholders are still debating how to adapt responsible disclosure frameworks to account for AI’s rapid exploit development capabilities, and whether new standards or regulations will emerge to regulate disclosure timelines.
Next Steps for Vulnerability Management and Policy
Security organizations, vendors, and regulators are expected to reevaluate disclosure policies in light of AI advancements. Immediate priorities include developing new frameworks that account for near-instantaneous exploit development, enhancing detection at the application layer, and increasing transparency around AI-driven vulnerability discovery. Monitoring AI activity on code repositories and establishing new collaboration channels may become essential to managing emerging risks.
Key Questions
Why did the 90-day disclosure window become ineffective?
Because advances in AI now enable attackers to analyze patches and develop exploits within minutes, eliminating the traditional time advantage defenders relied on.
What vulnerabilities are most affected by this shift?
Trust boundary failures at the application and integration layers, such as OAuth scopes, SaaS permissions, and environment-variable handling, are now more vulnerable than traditional memory-safety bugs.
Will the responsible disclosure model be replaced?
It is uncertain; stakeholders are currently debating whether new policies or standards will emerge to address the rapid development and weaponization of exploits facilitated by AI.
What can organizations do to protect themselves?
Organizations should enhance monitoring at the application layer, adopt AI-based detection tools, and implement stricter access controls on trust boundaries to mitigate emerging risks.
Source: ThorstenMeyerAI.com
