📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day coordinated vulnerability disclosure window has closed without any vendor notice or patch deployment. This shift is driven by AI capabilities that enable rapid exploit development, impacting cybersecurity defenses and practices.
Vendors and security researchers have confirmed that the traditional 90-day window for vulnerability disclosure has effectively ended, with no notices or patches issued during this period. This shift, driven by AI-powered tools capable of rapid exploit development, marks a significant change in cybersecurity practices and threat dynamics.
Historically, the 90-day disclosure window, popularized by Google Project Zero in 2014, provided a structured period during which vendors could patch vulnerabilities before they were publicly disclosed. This window was based on assumptions that reverse engineering patches and developing exploits took meaningful time, giving defenders a crucial advantage.
However, recent developments in AI-driven vulnerability analysis have shattered these assumptions. The commit for a Linux kernel vulnerability, Copy Fail, was publicly available on April 1, 2026. Within days, AI systems could reconstruct exploits from the diff, and attackers monitoring kernel commits could weaponize the bug before the vendor issued a patch or even before the public disclosure on April 29.
Furthermore, the collapse of the knowledge floor for discovering vulnerabilities means even engineers without formal security training can generate working exploits using AI prompts. The focus of recent breaches, such as those at Vercel and Canvas, indicates that the most critical vulnerabilities now lie in trust boundary failures—OAuth scopes, SaaS integrations, third-party permissions—rather than traditional memory-safety bugs.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
NetAlly CyberScope Air Wi-Fi Edge Network Vulnerability Scanner (Wireless Only Version). Validate Edge Infrastructure Hardening, Hunt Down Rogue Devices, Investigate Suspect RF Interference
Portable, handheld form factor – Take it anywhere for on-site security testing. This field-ready tool gives you visibility…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
network security monitoring tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
penetration testing kit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
secure coding training books
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
This development significantly alters the cybersecurity landscape. The traditional advantage defenders had—time to patch before exploits became widespread—is eroding rapidly. Attackers can now develop and deploy exploits almost immediately after a vulnerability is committed, reducing the window for effective defense and patching.
Moreover, the shift toward trust boundary vulnerabilities means that existing defensive measures focused on memory safety are less effective. Attackers exploiting integration points and permissions can bypass many traditional protections, making organizations more vulnerable unless new security approaches are adopted.
Background on the Evolution of Disclosure and AI Impact
The 90-day disclosure window was established to balance the interests of researchers and vendors, providing a period for patches before public disclosure. This framework depended on the difficulty of reverse engineering patches and the time needed to develop exploits. However, recent advances in AI, such as Theori’s code analysis tools, have drastically reduced these times, enabling real-time monitoring and exploit development.
The Linux kernel vulnerability, Copy Fail, exemplifies this shift. Its commit was public on April 1, 2026, and within days, AI systems could produce working exploits. This rapid turnaround challenges the foundational assumptions of responsible disclosure and highlights the increasing importance of trust boundary security issues over traditional memory safety bugs.
“The 90-day window, once a defender’s advantage, is no longer effective against AI-fueled rapid exploit development.”
— Thorsten Meyer
Unclear Impact on Future Disclosure Practices
It remains uncertain how vendors and the cybersecurity community will adapt to this paradigm shift. There is no consensus yet on new standards or frameworks to replace the 90-day window, and the pace of AI development may accelerate these changes further.
Next Steps for Cybersecurity and Vulnerability Management
Organizations will need to reevaluate their security strategies, focusing more on trust boundary protections and continuous monitoring. Vendors may adopt new disclosure models or security practices to mitigate AI-driven rapid exploit development. Researchers and defenders must collaborate to develop proactive defenses that account for near-instantaneous threat emergence.
Key Questions
Why did the 90-day disclosure window end without notice?
AI tools now enable rapid reverse engineering and exploit development, making the traditional 90-day window ineffective for protecting systems before exploits are weaponized.
What types of vulnerabilities are now most concerning?
Trust boundary failures, such as OAuth scope issues, SaaS integration flaws, and third-party permission misconfigurations, are now the most critical vulnerabilities.
How can organizations defend against these rapid exploits?
Organizations should enhance trust boundary security, implement continuous monitoring, and adopt proactive security measures tailored to AI-driven threat landscapes.
Will the responsible disclosure framework be replaced?
It is unclear; the cybersecurity community is still debating new standards, but the current trend suggests a need for more immediate and dynamic defense strategies.
Source: ThorstenMeyerAI.com
