📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day coordinated disclosure window has effectively ended, with no vendors issuing notices for recent high-profile vulnerabilities. AI-driven discovery now allows exploits to be developed faster than patches can be deployed, shifting the security landscape.
Vendors have not issued any notices or patches within the traditional 90-day window following recent high-profile security disclosures, signaling a fundamental shift in vulnerability management and threat dynamics.
Since the adoption of the 90-day coordinated disclosure policy, vendors were expected to respond within three months of a vulnerability report. However, recent cases, including the Linux kernel’s Copy Fail bug and breaches at Vercel and Canvas, demonstrate that attackers can now exploit vulnerabilities in real-time, often before patches are publicly available.
The Linux kernel patch for Copy Fail was committed on April 1, 2026, but no vendor or affected organization issued a notice or patch by the end of the 90-day window on June 30, 2026. Meanwhile, AI-driven tools can monitor kernel commits, reverse engineer patches, and develop exploits within minutes—a process that previously took days or weeks.
Experts warn that this shift diminishes the protective advantage historically held by defenders, as attackers can now operate with near real-time intelligence, rendering the traditional 90-day window obsolete. The recent breaches at Vercel (April 19) and Canvas (May 1) further highlight that modern vulnerabilities often reside in trust boundaries, such as OAuth scopes and SaaS integrations, rather than traditional memory safety bugs.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Security Monitoring with Wazuh: A hands-on guide to effective enterprise security using real-life use cases in Wazuh
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Cute-Patch It Works on My Machine Meme Embroidered Iron on sew on Patch Funny Emblem Programmer Humor
Size: 3 inches tall
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
DEFCON™ Pulse Tag – Personal EMP Detection System | EDC Protection, Military-Grade, Prepper and Preparedness, Threat Awareness, High Security
❌EMP Detection System: A wearable, personal EMP detection system than can be clipped on your bag or key…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Truth Engine: Applying AI to Investing
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
The collapse of the 90-day disclosure window marks a new era in cybersecurity, where attackers can rapidly weaponize vulnerabilities before organizations can respond. This shift challenges existing patching and defense strategies, emphasizing the need for proactive monitoring and AI-driven security measures. The trend also raises questions about the future of responsible disclosure and the role of vendors in a landscape where information is exploited almost instantaneously.
Evolving Vulnerability Discovery and Response Practices
The 90-day coordinated disclosure policy, established in the early 2000s and popularized by Google Project Zero in 2014, was based on the assumption that reverse engineering patches takes significant time, allowing defenders to deploy patches before attackers can exploit vulnerabilities publicly. However, recent technological advances, especially in AI, have drastically shortened or eliminated this window.
The April 1, 2026, Linux kernel commit for Copy Fail exemplifies this shift. The patch was public from the moment it was committed, and AI tools could analyze the diff, understand the bug, and develop exploits within minutes. This undermines the core assumptions of the traditional disclosure model and accelerates the threat landscape.
Furthermore, recent breaches at Vercel and Canvas demonstrate that the most critical vulnerabilities now lie in trust boundaries—OAuth permissions, SaaS-to-SaaS integrations, environment variables—areas that are less protected by traditional memory safety defenses.
“The collapse of the 90-day window fundamentally alters the cybersecurity landscape, making real-time exploitation a new norm.”
— Thorsten Meyer
Unresolved Questions About Future Security Practices
It remains unclear how organizations will adapt their security and patching strategies in response to the accelerated threat timeline. The long-term effectiveness of current defenses against AI-enabled exploits is also uncertain, as is the potential for new regulatory or industry standards to emerge.
Next Steps for Security Stakeholders in a Rapid-Exploit Era
Organizations will need to enhance their real-time monitoring capabilities, leverage AI for threat detection, and reconsider traditional patching timelines. Industry and regulators may also explore new frameworks to address the diminished role of the 90-day window, possibly emphasizing proactive defense and zero-trust architectures. Ongoing research and case studies from recent breaches will shape these developments in the coming months.
Key Questions
Why is the 90-day disclosure window no longer effective?
Advances in AI enable exploits to be reconstructed and weaponized within minutes of a patch’s public release, eliminating the buffer period that the 90-day window was designed to provide.
What vulnerabilities are most affected by this shift?
Trust boundary vulnerabilities, such as OAuth scopes, SaaS integrations, and environment-variable handling, are now more critical than traditional memory safety bugs, as they are less protected by existing defenses.
How should organizations respond to this new threat landscape?
Organizations should adopt real-time monitoring, AI-driven threat detection, and zero-trust security models to mitigate risks posed by rapid exploit development.
Will vendors change their disclosure policies?
It is uncertain; some experts suggest new frameworks may be needed, but current practices are unlikely to revert to the traditional 90-day model given the technological realities.
What role will AI play in future cybersecurity efforts?
AI will be both a tool for defenders to detect threats faster and a weapon for attackers to develop exploits more quickly, fundamentally transforming cybersecurity dynamics.
Source: ThorstenMeyerAI.com
