📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The standard 90-day window for coordinated vulnerability disclosure has effectively ended without any security notice from vendors or researchers. This shift is driven by AI-enabled rapid exploit development, raising concerns about new security vulnerabilities and response strategies.
The traditional 90-day coordinated disclosure window for security vulnerabilities has effectively ended without any notice from vendors or researchers, following the Linux kernel patch for Copy Fail committed on April 1, 2026. This marks a significant shift in vulnerability management, driven by advances in AI that enable near-instantaneous exploit development.
On April 1, 2026, the Linux kernel patch for the Copy Fail vulnerability was committed publicly. Normally, this would trigger a 90-day window during which vendors develop patches and researchers prepare disclosures, giving defenders time to respond. However, by April 29, the patch was publicly available, and the bug was easily rediscoverable from the diff. AI systems monitoring kernel commits can now analyze patches and generate exploits within minutes, collapsing the traditional window between patch release and exploit development.
Despite the end of this window, no security notice or coordinated disclosure has been issued by vendors or researchers, raising questions about the future of responsible disclosure practices. The collapse of the knowledge floor—where reverse engineering and expert analysis were once necessary—has enabled even non-specialists, aided by AI, to find and weaponize vulnerabilities rapidly.
This shift is exemplified by recent breaches at Vercel (April 19) and Canvas (May 1), where vulnerabilities related to trust boundaries, OAuth scopes, and SaaS integrations were exploited. These incidents highlight that the most critical vulnerabilities in 2026 are no longer memory-safety bugs but failures at the trust boundary, which are less protected by traditional defenses.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Linux kernel security patch monitoring tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Generative AI-Powered Assistant for Developers: Accelerate software development with Amazon Q Developer
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Network Vulnerability Assessment: Identify security loopholes in your network's infrastructure
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
The Safety Toolkit: Practical Tools for Staying Safe When Risk Is Unclear
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the Disclosure Window
This development fundamentally alters the landscape of cybersecurity. The end of the 90-day window means attackers can exploit vulnerabilities almost immediately after patches are released, reducing the time defenders have to respond. It shifts the advantage from defenders to attackers, increasing the risk of widespread, rapid exploitation. For organizations relying on traditional patching and disclosure protocols, this signals a need to rethink vulnerability management and threat detection strategies.
Moreover, the collapse of the knowledge floor lowers the barrier for attackers, enabling less sophisticated actors to develop exploits. The focus on trust boundary vulnerabilities at SaaS and API layers suggests that defensive measures must evolve beyond memory safety and into better protection of integration points and access controls. This new environment demands more proactive, AI-driven security monitoring and response systems.
The Evolution of Vulnerability Discovery and Disclosure Practices
Historically, the 90-day window for responsible disclosure was established to balance the interests of researchers and vendors, allowing time to develop patches while preventing attackers from weaponizing unpatched vulnerabilities. This window relied on assumptions: that reverse engineering takes time, that patches are the first public signal, and that exploit development follows patch release.
Recent advances in AI, exemplified by systems like Theori’s Xint Code, have shattered these assumptions. AI can now analyze patches and generate exploits in minutes, making the window between patch release and exploit weaponization virtually nonexistent. The Linux kernel patch for Copy Fail, committed on April 1, 2026, exemplifies this shift, as the bug was easily reconstructed from the diff within days or even hours, and exploits could be developed before broad distribution of the patch.
Additionally, recent breaches at Vercel and Canvas demonstrate that vulnerabilities at trust boundaries—OAuth scopes, SaaS integrations—are now the most critical and least protected attack vectors, further emphasizing the evolving nature of security threats in this new landscape.
“The collapse of the knowledge floor and the end of the 90-day window mark a structural shift in vulnerability management, driven by AI’s rapid exploit development capabilities.”
— Thorsten Meyer
Unclear Impact on Future Vulnerability Disclosure Practices
It remains unclear whether vendors and the cybersecurity community will adopt new disclosure frameworks or protocols in response to this shift. The long-term implications for responsible disclosure, coordinated patching, and threat intelligence are still being evaluated, and some stakeholders may resist abandoning the traditional 90-day window.
Next Steps for Security Stakeholders in a Post-Window Era
Organizations should enhance their AI-driven monitoring and rapid response capabilities to cope with near-instant exploitation. Vendors may need to develop new disclosure policies or adopt continuous patching strategies. Researchers and security firms are likely to focus on trust boundary vulnerabilities and API security. The cybersecurity community is expected to debate and potentially develop new standards for vulnerability disclosure that reflect this new reality.
Key Questions
Why did the 90-day disclosure window become obsolete?
AI systems can analyze patches and develop exploits within minutes, collapsing the time advantage traditionally held by defenders during the 90-day window.
What types of vulnerabilities are most affected by this change?
Vulnerabilities related to trust boundaries, SaaS integrations, OAuth scopes, and third-party permissions are now the most critical, as they are less protected by memory safety defenses.
Will responsible disclosure practices disappear entirely?
It is uncertain; some stakeholders may attempt to develop new protocols, but the current trend suggests a move toward more immediate, perhaps continuous, disclosure and patching models.
How should organizations adapt to this new environment?
Organizations should invest in AI-enabled security monitoring, adopt rapid patching workflows, and focus on securing trust boundaries and integration points to mitigate risks.
Source: ThorstenMeyerAI.com
