📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day coordinated disclosure window has effectively ended, with no notices sent by vendors or researchers. This shift is driven by AI-driven vulnerability discovery, which accelerates exploit development and erodes traditional defense timelines.
Organizations and security researchers did not send any notices or disclosures within the 90-day window following the public release of the Linux kernel patch for the Copy Fail vulnerability on April 29, 2026, signaling a shift in the traditional vulnerability disclosure process.
The Linux kernel patch for Copy Fail was committed on April 1, 2026, and made public on April 29. During the four-week window, the patch was publicly available, enabling AI-driven systems to analyze and potentially develop exploits in minutes, rather than days or weeks. No coordinated or private notices from vendors or researchers have been observed, marking the end of the conventional 90-day disclosure period.
This change is driven by advances in AI, such as Theori’s Xint Code, which can rapidly analyze code commits, identify security implications, and generate exploits with minimal human input. As a result, the traditional advantage for defenders—time to patch before exploits become widespread—has been significantly diminished. The collapse of the knowledge floor for discovering vulnerabilities and the shift toward trust-boundary failures at integration points further complicate defensive efforts.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Linux kernel security patch monitoring tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
IoT Software Vulnerability Detection Technology(Chinese Edition)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
AI-based code analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Artificial Intelligence for Cybersecurity: How AI Detects Cyber Threats, Prevents Hacking, and Protects Your Data, Identity, and Smart Devices (AI Cybersecurity Mastery Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
This development fundamentally alters cybersecurity dynamics, favoring attackers who can now weaponize vulnerabilities immediately after patches are released. It challenges existing defensive strategies, which relied on the assumption that defenders would have a window to deploy patches before exploits emerge publicly. The shift also indicates that vulnerabilities are increasingly found at the integration and trust boundary layers, where traditional memory-safety defenses are less effective, and AI-driven discovery accelerates exploit development.
Background on Responsible Disclosure and Its Changing Landscape
The 90-day coordinated disclosure window, established in the early 2000s and popularized by Google Project Zero in 2014, was designed to balance the interests of researchers and vendors. It provided a period for vendors to develop patches before vulnerabilities were disclosed publicly. However, recent technological advances—particularly AI systems capable of rapid code analysis and exploit generation—have rendered this window obsolete. The April 2026 disclosures, including the Linux kernel patch for Copy Fail, exemplify how AI can bypass traditional timelines, making the disclosure window effectively meaningless.
“The collapse of the 90-day window marks a new era where attackers can weaponize vulnerabilities immediately after patches are public, fundamentally changing cybersecurity defense strategies.”
— Thorsten Meyer
Unclear Impact and Future of Vulnerability Disclosure
It is not yet clear how widespread the practice of silent exploitation has become or whether organizations will adopt new disclosure norms. The long-term effects on cybersecurity policy, legal frameworks, and international coordination remain uncertain as AI-driven exploits become more prevalent and immediate.
Next Steps for Cybersecurity Practices and Policies
Stakeholders are likely to reevaluate disclosure policies, with some considering mandatory reporting or new frameworks to address AI-facilitated vulnerabilities. Monitoring trends in exploit development and patch deployment will be critical, alongside efforts to strengthen security at trust boundaries. Further research and policy discussions are expected in the coming months to adapt to this rapidly changing landscape.
Key Questions
Why did no notices get sent within the 90-day window?
Advances in AI allow attackers to analyze patches and develop exploits almost immediately, making the traditional 90-day window obsolete and reducing the incentive for private disclosure.
What does this mean for software vendors and organizations?
They may face increased risk of undisclosed exploits being weaponized quickly after patches are released, requiring new strategies for vulnerability management and threat detection.
Will the responsible disclosure process still exist?
It is uncertain; the traditional model is under strain, and new policies or norms may emerge to address AI’s impact on vulnerability disclosure and exploitation.
How does AI accelerate exploit development?
AI systems can analyze code commits, identify security implications, and generate exploits in minutes, significantly reducing the time from patch release to weaponization.
What vulnerabilities are most concerning now?
Trust boundary failures at integration points, such as OAuth scopes and SaaS-to-SaaS authentication, are increasingly exploited, as they are less protected by traditional memory-safety defenses.
Source: ThorstenMeyerAI.com
