📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The standard 90-day window for vulnerability disclosure has expired without any vendor notice, as AI tools can now exploit patches within days. This shift challenges traditional cybersecurity defenses and disclosure norms.
The 90-day coordinated disclosure window for a critical Linux kernel vulnerability has closed without any notice or patch from the affected vendors, signaling a fundamental shift in cybersecurity dynamics.
Traditionally, the 90-day window established by initiatives like Google Project Zero provided a period during which vendors could respond to and patch vulnerabilities before public disclosure. However, recent developments in AI-driven vulnerability discovery have effectively dismantled this window. In April 2026, a Linux kernel patch addressing the Copy Fail vulnerability was committed on April 1, and by April 29, it was publicly disclosed. During this period, AI tools capable of monitoring kernel commits could reverse engineer the patch and develop exploits within days, or even minutes.
Sources confirm that the diff from the patch is sufficient for an AI system to understand the bug and generate working exploits rapidly. This means attackers with AI capabilities could have weaponized the vulnerability before the patch was publicly available, rendering the traditional 90-day window obsolete. The lack of vendor notification or patch deployment during this period underscores the new reality where AI accelerates exploit development and reduces the window for defenders to respond.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Networks Attacks and Defense; Tools and Resources
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Implications of the Disappearing Disclosure Window
This development signifies a paradigm shift in cybersecurity, where the traditional defender advantage of a 90-day window no longer applies. Attackers equipped with AI can now discover, understand, and exploit vulnerabilities in real time, often before vendors are even aware of the issues. This accelerates the threat landscape, increases the risk of widespread exploitation, and challenges existing defensive strategies that rely on delayed patch deployment and coordinated disclosure.
Evolving Cybersecurity Challenges in 2026
Since the early 2000s, the responsible disclosure framework relied on a balance: vendors had 90 days to patch after a vulnerability was reported, giving defenders time to deploy updates before exploits became widespread. This model depended on the assumption that reverse engineering a patch and developing exploits required significant time and skill. However, recent advances in AI, exemplified by tools like Theori’s Xint Code and Anthropic’s Mythos, have drastically shortened this timeline. The Linux kernel patch for Copy Fail was committed on April 1, 2026, and publicly disclosed on April 29, but AI systems could have reconstructed the exploit within days or hours, eroding the original purpose of the window.
Additionally, recent breaches at Vercel and Canvas reveal that the most critical vulnerabilities are now at trust boundaries—OAuth scopes, SaaS integrations, environment-variable handling—areas less protected by traditional memory safety defenses. These shifts highlight a fundamental change in the threat landscape, driven by AI’s ability to surface vulnerabilities in complex, integrated systems.
“The 90-day window is no longer a defender’s advantage; AI can exploit patches in minutes, not months.”
— Thorsten Meyer
Unanswered Questions About Future Security Frameworks
It remains unclear how vendors and security agencies will adapt to this accelerated threat environment. The effectiveness of existing patching and disclosure protocols is in question, and it is not yet confirmed whether new regulatory or technical measures will be implemented to address the rapid exploitation enabled by AI.
Next Steps for Cybersecurity Defense Strategies
Security organizations and vendors are expected to reevaluate their response protocols, possibly moving toward continuous monitoring and automated patch deployment. Further research and development are likely to focus on AI-powered defenses that can detect and mitigate exploits in real time, as well as new frameworks to manage disclosure and response in an AI-enhanced threat landscape.
Key Questions
Why did the 90-day disclosure window become irrelevant?
Because AI can now analyze patches and develop exploits within days or minutes, eliminating the time advantage that the window provided to defenders.
What vulnerabilities are most affected by this shift?
Trust boundary failures at integration points like OAuth, SaaS-to-SaaS authentication, and environment-variable handling are now the most critical, rather than traditional memory-safety bugs.
Will the responsible disclosure process be replaced?
It is uncertain; current developments suggest a move toward more continuous, automated security practices, but formal frameworks are still evolving.
How are vendors responding to these changes?
Many are exploring AI-driven monitoring and patching solutions, but widespread adoption and effective strategies are still in development.
Source: ThorstenMeyerAI.com
