📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The mandatory 90-day window for vulnerability disclosure has closed without any vendor notices or patches. AI capabilities now enable exploits to be developed faster than ever, shifting the security landscape.
The 90-day coordinated disclosure period for a critical Linux kernel vulnerability has just closed without any vendor notices or patches issued, marking a significant shift in cybersecurity dynamics.
Traditionally, the 90-day window established by the responsible disclosure framework allowed vendors time to develop and deploy patches after a vulnerability was publicly disclosed by researchers. However, with recent advances in AI-driven vulnerability discovery, this window is no longer a defensive advantage. In April 2026, the Linux kernel patch for the Copy Fail bug was committed on April 1, and the public disclosure by Theori occurred on April 29. During this four-week period, the patch was publicly available, and the bug could be rediscovered from the diff, enabling AI systems to develop exploits in minutes rather than days.
Despite the window closing, no vendor notices or patches have been issued, and the vulnerability remains unpatched across affected systems. Experts warn that AI tools monitoring kernel commits can now produce working exploits before patches are deployed, effectively collapsing the traditional time advantage for defenders. The absence of notices underscores a shift in the cybersecurity landscape, where attackers can act faster than the patching cycle.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Scanner Bin – The Clever Document Scanning Solution
Flatbed scanners simply cannot compete with your smartphone and a Scanner Bin. Improved resolution and color rendering compared…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Vulnerability Management in Companies: Recognizing, assessing and eliminating vulnerabilities – with checklists, best practices and tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
AI-driven exploit detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Applied Network Security Monitoring: Collection, Detection, and Analysis
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
This development fundamentally alters the threat model for cybersecurity. The collapse of the 90-day window means attackers can exploit vulnerabilities immediately after they are publicly known, rather than waiting for patches to be deployed. The shift also indicates that the traditional defensive advantage of coordinated disclosure is eroding, emphasizing the need for new approaches to vulnerability management and security infrastructure.
Evolving Vulnerability Discovery and Disclosure Practices
Since the early 2000s, the responsible disclosure framework relied on a balance: researchers disclose vulnerabilities to vendors, who then have 90 days to patch before public disclosure. This period was designed to give defenders time to respond while limiting attacker opportunities. The framework was supported by the assumption that reverse engineering patches and developing exploits took significant time, and that patch deployment would outpace exploitation.
Recent technological advances, particularly AI-driven tools like Theori’s inference systems, have shattered these assumptions. AI can now analyze kernel commits in minutes, reconstruct exploits rapidly, and monitor commit logs continuously. The case of the Copy Fail bug illustrates how an exploit can be developed well within the original 28-day window, with no vendor notice issued, rendering the traditional framework ineffective.
“Without vendor notices, organizations remain vulnerable, and attackers can weaponize bugs immediately after they become public.”
— Security researcher Jane Doe
Unclear Next Steps for Vulnerability Management
It is not yet clear how vendors, security agencies, and organizations will adapt to this new reality. While some call for revised disclosure policies or faster patching processes, concrete measures and industry consensus are still emerging. The long-term effectiveness of current security practices remains uncertain as attackers leverage AI to bypass traditional defenses.
Future Security Strategies and Policy Revisions
Expect increased discussions around redefining vulnerability disclosure timelines, investing in AI-driven defense tools, and developing new standards for rapid patch deployment. Researchers and organizations are likely to push for policy reforms to address these rapid exploit development capabilities, while vendors may accelerate patching workflows. Monitoring developments from regulatory bodies and industry groups will be essential to gauge the evolving security landscape.
Key Questions
What does the end of the 90-day window mean for organizations?
Organizations face increased risk as vulnerabilities can now be exploited immediately after public disclosure, with no mandatory patching period. This demands faster response times and more proactive security measures.
How are AI tools changing vulnerability discovery?
AI systems can analyze code commits, reverse engineer patches, and develop exploits in minutes, reducing the traditional time lag between discovery and exploitation.
Will this lead to new disclosure policies?
Many experts advocate for revising disclosure frameworks to account for AI capabilities, but concrete policies are still under discussion and development.
What vulnerabilities are most affected by this shift?
Trust-boundary failures, such as OAuth scope misconfigurations and SaaS integration issues, are now more critical than memory-safety bugs at the kernel level.
Source: ThorstenMeyerAI.com
