📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The traditional 90-day window for vulnerability disclosure has effectively closed, with no notices from affected vendors. AI capabilities now enable exploits before patches are widely deployed, shifting the security landscape.
Vendors have not issued any notices or patches within the 90-day window following the Linux kernel commit for Copy Fail on April 1, 2026, despite AI systems capable of reconstructing exploits in minutes. This marks a significant shift in vulnerability management and disclosure practices, with implications for cybersecurity defenses worldwide.
The 90-day coordinated disclosure window, established in the early 2000s and popularized by Google Project Zero in 2014, has traditionally provided a balanced period for vendors to patch vulnerabilities while allowing researchers to disclose bugs publicly. However, in 2026, this window has effectively become obsolete due to advancements in AI-driven vulnerability discovery.
On April 1, 2026, the Linux kernel team committed a patch for the Copy Fail vulnerability. Despite the patch being public from that moment, no vendor or organization issued a notice or patch within the subsequent 28 days, which is now considered a dangerous vulnerability window. AI systems monitoring kernel commits can analyze diffs and reconstruct exploits in minutes, allowing attackers to weaponize bugs before patches are deployed or even announced.
This shift is reinforced by recent security breaches at Vercel (April 19) and Canvas/Instructure (May 1), which reveal that the most critical vulnerabilities in 2026 are not memory-safety bugs but trust boundary failures at system integration points, such as OAuth scopes and SaaS permissions. These vulnerabilities are less protected by traditional defenses and are more susceptible to AI-driven discovery and exploitation.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Cybersecurity Analyst Coffee Mug – Vulnerability Scanner by Day Ninja by Night – 11 oz White Ceramic – Bold Design
BOLD CYBERSECURITY DESIGN: Features the phrase 'Vulnerability Scanner by Day Ninja by Night' with striking alert icons and…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
AI-based vulnerability detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Cute-Patch It Works on My Machine Meme Embroidered Iron on sew on Patch Funny Emblem Programmer Humor
Size: 3 inches tall
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
Used Book in Good Condition
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
This development fundamentally alters the cybersecurity landscape. The collapse of the 90-day window means attackers can now discover, develop, and deploy exploits before vendors even issue notices or patches. It shifts the advantage from defenders to attackers, necessitating new strategies for vulnerability management, monitoring, and defense.
Organizations relying on traditional patching cycles face increased risks, as AI tools can now scan commit histories and produce working exploits in minutes. The focus must shift toward proactive detection, real-time monitoring, and securing trust boundaries at the system and application layers, where recent breaches have shown vulnerabilities are concentrated.
Evolving Vulnerability Discovery and Disclosure Practices
The responsible disclosure model emerged in the early 2000s, based on the assumption that patches take time to develop and deploy, providing a window for defenders. This model depended on three key assumptions: that reverse engineering a patch takes meaningful time, that patches are the first public signal of a bug, and that patch deployment outpaces exploit development.
However, AI advancements in 2026 have shattered these assumptions. AI systems can analyze patches and commit logs within minutes, reconstruct exploits rapidly, and monitor kernel commits in real-time. The recent breaches at Vercel and Canvas exemplify how vulnerabilities at trust boundaries are now the primary threat, bypassing traditional memory safety defenses.
“The 90-day window is no longer a defender’s advantage; it has become an attacker’s window due to AI-driven vulnerability discovery.”
— Thorsten Meyer
Unclear Impact on Future Vulnerability Management
It remains uncertain how organizations will adapt to this new reality. While the collapse of the 90-day window is confirmed, the effectiveness of new defensive measures, such as real-time monitoring and trust boundary security, is still being tested. The long-term impact on disclosure policies and legal frameworks is also unclear.
Next Steps for Security Strategies and Policy Adjustments
Organizations will need to develop and implement real-time monitoring tools capable of detecting exploit activity at the moment of vulnerability discovery. Regulatory bodies and industry groups may revisit disclosure policies to address the reduced window for patch deployment. Additionally, increased focus on securing trust boundaries and minimizing attack surfaces at the application and integration levels is expected.
Further research and collaboration between security vendors, researchers, and policymakers will be critical to adapt to these rapid changes and mitigate emerging risks.
Key Questions
What does the end of the 90-day window mean for cybersecurity?
It means attackers can now exploit vulnerabilities before vendors issue notices or patches, shifting the advantage away from defenders and increasing the urgency for real-time detection and mitigation strategies.
Why are recent breaches at Vercel and Canvas significant?
They demonstrate that the most critical vulnerabilities are now trust boundary failures at system integration points, which are less protected by traditional defenses and more susceptible to AI-driven discovery.
Can traditional patching and disclosure practices still be effective?
They are less effective in the current environment where AI can rapidly analyze patches and develop exploits. New approaches focusing on proactive detection and securing trust boundaries are needed.
What are the risks for organizations relying on older security models?
They face increased exposure to zero-day exploits and attacks that can be developed and weaponized before patches are available or announced, requiring immediate adaptation of security practices.
Source: ThorstenMeyerAI.com
