📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.

The 90-day window for responsible disclosure of security vulnerabilities has officially closed without any notices from affected vendors, marking a significant shift in cybersecurity practices. This development, confirmed by industry sources, indicates that the traditional advantage held by defenders is eroding, with attackers now able to exploit vulnerabilities faster than patches can be issued.

Historically, the 90-day coordinated disclosure window, established by initiatives like Google Project Zero in 2014, provided a structured period for vendors to patch vulnerabilities after they were reported by researchers. During this window, defenders could deploy patches before malicious actors weaponized the flaws. However, recent developments in AI-driven vulnerability discovery have disrupted this balance.

In April 2026, a security patch for the Linux kernel addressing the ‘Copy Fail’ vulnerability was committed on April 1. Public disclosure occurred on April 29, but during the four-week window, AI tools capable of monitoring kernel commits and analyzing diffs could reconstruct exploits in minutes—much faster than traditional reverse engineering. Experts warn this means attackers can now discover and weaponize vulnerabilities before vendors even issue notices.

Additionally, recent breaches at Vercel and Canvas highlight a shift in the types of vulnerabilities exploited. Instead of memory safety bugs, attackers are targeting trust boundary failures, such as OAuth scope misconfigurations and third-party app permissions, which are less protected by existing defensive measures. These vulnerabilities are often in the integration seams, not the core kernel, and are more accessible to AI-driven discovery.

Implications of the Disappearance of the Disclosure Window

This shift fundamentally alters the cybersecurity landscape. With the 90-day window effectively dismantled, defenders lose their primary advantage of deploying patches before attackers can weaponize vulnerabilities. The rise of AI tools capable of rapid exploit development means threats are now immediate and more widespread. This change increases the urgency for organizations to enhance their security measures at the application and integration levels, where traditional defenses are less effective.

Evolving Threats and the Breakdown of Traditional Disclosure

Since the early 2000s, the responsible disclosure framework relied on a mutual understanding: researchers would report vulnerabilities, and vendors would have a limited window to patch before public disclosure. This balance aimed to give defenders a head start. However, recent advancements in AI, exemplified by tools like Theori’s Xint Code, have drastically shortened or eliminated this window. The April 2026 Linux kernel patch is a case in point, where AI can reconstruct exploits from commits in minutes, not days or weeks.

Prior to this, the security community believed that reverse engineering a patch was a significant barrier to attackers. Now, AI tools have lowered that barrier to near zero, enabling even less experienced actors to develop exploits rapidly. The breaches at Vercel and Canvas further demonstrate that vulnerabilities at the trust boundary are now prime targets, and these are less protected by traditional security measures.

“The 90-day window, once a defender’s advantage, is now effectively a vulnerability window for attackers, thanks to AI-driven discovery.”

— Thorsten Meyer

Unclear Impact on Future Patch and Disclosure Practices

It remains uncertain how vendors will adapt to this new reality. Will new disclosure frameworks emerge? How quickly will organizations implement more robust security measures at the application layer? The long-term effects on cybersecurity norms and regulations are still developing, and industry responses are not yet clear.

Next Steps for Industry and Security Practices

Organizations should reassess their security strategies, especially around trust boundaries and third-party integrations. Vendors may need to develop faster patching cycles or alternative disclosure methods. Industry groups are likely to explore new frameworks to address the accelerated threat landscape. Monitoring AI-driven exploit techniques will become essential for proactive defense.

Key Questions

What does the end of the 90-day window mean for cybersecurity?

It means attackers can now exploit vulnerabilities faster than vendors can patch and disclose, reducing defenders’ ability to respond proactively.

Why are trust boundary vulnerabilities becoming more prominent?

Because modern breaches, like those at Vercel and Canvas, show that vulnerabilities at integration points are easier to exploit and less protected by traditional defenses.

How are AI tools changing vulnerability discovery?

AI can analyze code commits and patches in minutes, reconstruct exploits rapidly, and even generate working exploits without formal security training.

What can organizations do to protect themselves now?

Organizations should strengthen security at trust boundaries, monitor AI-driven exploit techniques, and consider faster patching and more dynamic security frameworks.

Source: ThorstenMeyerAI.com