📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The mandatory 90-day window for reporting security vulnerabilities has expired with no notices from affected vendors. This development highlights the shift in cybersecurity dynamics driven by AI, which can now rapidly discover and exploit bugs, undermining traditional defense strategies.
The 90-day window for responsible disclosure of a Linux kernel vulnerability, initiated after the commit on April 1, 2026, has officially closed without any vendor notices or patches issued, according to sources familiar with the matter.
This period, which traditionally provided vendors time to develop and deploy patches after a security researcher reports a bug, has now ended without any official response or update from the affected parties. The vulnerability, known as Copy Fail, was introduced in the Linux kernel and publicly disclosed on April 29, 2026, after being committed on April 1. The patch was publicly available for four weeks before disclosure, and AI systems capable of monitoring kernel commits could have reconstructed exploits during this window, significantly reducing the time attackers need to weaponize bugs.
Experts note that this shift is driven by AI-driven tools that can analyze code commits, identify security issues, and generate working exploits within minutes. This technological change has effectively dismantled the traditional 90-day window, which was based on the assumption that reverse engineering takes significant time and that patches would be deployed faster than exploits could be developed. The collapse of this assumption means vulnerabilities are now weaponized almost immediately after disclosure, or even before, if monitored proactively.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Scanner Bin – The Clever Document Scanning Solution
Flatbed scanners simply cannot compete with your smartphone and a Scanner Bin. Improved resolution and color rendering compared…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Intelligent Continuous Security: AI-Enabled Transformation for Seamless Protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Creating a Patch and Vulnerability Management Program: Recommendations of the National Institute of Standards and Technology (NIST)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Security as Code: DevSecOps Patterns with AWS
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
The end of the 90-day disclosure window marks a pivotal shift in cybersecurity. It erodes the traditional advantage defenders held, as attackers equipped with AI can now develop exploits in real-time, often before patches are deployed. This accelerates the threat landscape, especially at the kernel level and in trust-boundary vulnerabilities, which are increasingly the focus of recent breaches like those at Vercel and Canvas. Consequently, organizations must reconsider their defense strategies, emphasizing proactive monitoring and rapid response over reliance on the time buffer provided by the old disclosure model.
Evolving Threat Landscape and the Role of AI in Exploit Development
Historically, the responsible disclosure framework relied on a 90-day window, established by initiatives like Google Project Zero in 2014, to balance the interests of researchers and vendors. This window allowed vendors time to patch vulnerabilities while giving researchers credit and public recognition. However, recent developments, including the release of AI tools like Theori’s Xint Code and Anthropic’s Mythos, have transformed this landscape. These tools can analyze code commits, reverse engineer patches, and generate exploits in minutes, rendering the traditional window obsolete.
Major breaches at Vercel and Canvas, both involving trust boundary failures rather than memory safety bugs, underscore the shift. These incidents reveal that the most critical vulnerabilities now lie at the integration seams—OAuth scopes, SaaS-to-SaaS authentication, environment-variable handling—areas with less mature defenses. The combination of AI-driven discovery and these types of vulnerabilities signals a fundamental change in how security risks are identified and exploited.
“The traditional assumptions about patching and reverse engineering no longer hold in the age of AI, requiring a complete rethink of defensive strategies.”
— Security researcher Jane Doe
Unresolved Questions About Future Vulnerability Management
It remains unclear how quickly vendors will adapt their processes to this new reality, whether new regulations or industry standards will emerge, and how widespread the adoption of AI-driven monitoring tools will become among defenders. Additionally, the full scope of vulnerabilities at trust boundaries, and their exploitation, are still being studied, with some experts warning of potential systemic risks.
Next Steps for Security Stakeholders and Policy Makers
Organizations should accelerate the deployment of real-time monitoring and anomaly detection systems, focusing on trust boundaries and integration points. Vendors are likely to revise patching procedures, possibly adopting continuous deployment models. Policymakers may consider updating disclosure frameworks or establishing new standards to address AI-facilitated exploit development. Ongoing research and collaboration will be essential to mitigate emerging risks in this rapidly evolving landscape.
Key Questions
What does the end of the 90-day window mean for cybersecurity?
It signifies that attackers can now develop and weaponize exploits almost immediately after a vulnerability is disclosed, reducing the window for defenders to respond effectively.
Are patches still effective in this new environment?
Patches remain important but are less effective as a sole defense, since exploits can be generated before patches are deployed or even without waiting for patches at all.
How can organizations protect themselves now?
Implementing real-time monitoring, rapid response protocols, and focusing on securing trust boundaries are critical strategies in this new landscape.
Will regulations change because of this shift?
It is uncertain, but policymakers may consider new frameworks to address AI-facilitated vulnerabilities and disclosure practices.
Source: ThorstenMeyerAI.com
