📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day window for responsible disclosure has expired without notices from affected vendors. This shift is driven by AI’s ability to rapidly discover and exploit vulnerabilities, undermining traditional defense strategies.
Vendors have not issued any notices or patches following the expiration of the 90-day disclosure window for the recent Linux kernel vulnerability, marking a significant shift in cybersecurity dynamics.
On April 1, 2026, a critical Linux kernel bug known as Copy Fail was patched in the mainline kernel. The patch was publicly available from that date, and the 90-day window for responsible disclosure officially closed on May 1, 2026, with no vendor notices or patches issued by affected vendors.
This marks a departure from traditional cybersecurity practices, as AI-driven vulnerability discovery now allows attackers to identify and weaponize bugs in minutes after a patch is released, effectively eliminating the defender’s advantage traditionally afforded by the 90-day window.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Linux kernel vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
cybersecurity vulnerability patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
cybersecurity threat detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearance of the 90-Day Window
This development indicates a fundamental shift in cybersecurity, where the window for defenders to respond quietly and patch vulnerabilities before attackers exploit them has collapsed. AI’s ability to rapidly analyze patches and develop exploits means that vulnerabilities can be weaponized immediately, reducing the effectiveness of traditional responsible disclosure and patching strategies.
Consequently, organizations must reconsider their vulnerability management and threat detection practices, as reliance on delayed patch deployment no longer provides a sufficient defense against highly capable attackers operating in real-time.
Background on Responsible Disclosure and AI’s Impact
Since the early 2000s, the responsible disclosure framework has relied on a 90-day window where vendors patch vulnerabilities before they are publicly disclosed, allowing defenders time to deploy patches and protect systems. This system was predicated on the assumption that reverse engineering and exploit development took significant time, and that patches were the first public signal of a vulnerability.
However, recent advances in AI, exemplified by tools like Theori’s Xint Code and Anthropic’s Mythos, have drastically shortened the time needed to discover, analyze, and exploit bugs. The Linux kernel’s Copy Fail vulnerability, patched on April 1, 2026, exemplifies how AI can reconstruct exploits from patches within minutes, making the 90-day window obsolete.
“The traditional 90-day window for responsible disclosure has effectively collapsed, as AI systems can now exploit patches in minutes, not weeks or months.”
— Thorsten Meyer
Unclear Impact on Future Patch and Disclosure Practices
It remains unclear how vendors and security communities will adapt to this new reality, including whether new disclosure frameworks or proactive defenses will emerge to counter AI-enabled exploits. The long-term effectiveness of traditional patching and notification processes is now in question, but specific policy changes or industry standards are still developing.
Next Steps for Cybersecurity Stakeholders
Organizations should enhance real-time monitoring and threat detection capabilities, focusing on trust boundary failures and third-party integrations. Vendors may need to develop faster patching cycles or adopt proactive disclosure models. Researchers and security teams are likely to explore new frameworks that account for AI’s rapid exploit development, aiming to restore some level of defensive advantage.
Key Questions
What does the end of the 90-day window mean for cybersecurity?
It indicates that attackers can now exploit vulnerabilities almost immediately after patches are released, significantly reducing the window defenders had to respond privately.
Why did the 90-day disclosure window exist?
It was designed to give defenders time to patch vulnerabilities before they became public knowledge and before attackers could weaponize them, based on the assumption that reverse engineering and exploit development took time.
How does AI accelerate vulnerability exploitation?
AI can analyze patches, reverse engineer vulnerabilities, and develop exploits in minutes, a process that previously took weeks or months for skilled researchers.
What vulnerabilities are most concerning now?
Trust boundary failures at integration points, such as OAuth scopes, SaaS-to-SaaS authentication, and third-party permissions, are becoming the primary targets, as they are less protected by memory safety defenses.
What should organizations do to stay protected?
Organizations should improve real-time monitoring, focus on trust boundary security, and consider adopting faster patching or proactive disclosure practices to mitigate AI-enabled exploits.
Source: ThorstenMeyerAI.com
