📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day coordinated disclosure period for security vulnerabilities has ended without any vendor notice. AI capabilities now allow exploits to be developed in minutes, undermining traditional defense assumptions.
The conventional 90-day window for coordinated security vulnerability disclosure has effectively ended without any notice from vendors or researchers, signaling a fundamental shift in cybersecurity dynamics. This change is driven by AI tools capable of rapidly analyzing patches and developing exploits within minutes, eroding the traditional defender advantage.
On April 1, 2026, the Linux kernel patch for the Copy Fail vulnerability was committed publicly. By April 29, 2026, the patch was widely available, and the bug was easily rediscoverable from the diff. In the four weeks between commit and public disclosure, AI systems monitoring kernel commits could have reconstructed and weaponized the exploit before downstream distributions shipped the patched kernel, according to cybersecurity analyst Thorsten Meyer.
This development breaks the long-standing assumption that reverse engineering a patch takes significant time, providing defenders with a window to deploy patches before attackers weaponize vulnerabilities. The collapse of this window means attackers can now develop exploits immediately after patches are public, using AI-driven tools that analyze code diffs and generate working exploits within minutes.
Additionally, recent breaches at Vercel and Canvas reveal that the most critical vulnerabilities in 2026 are no longer memory-safety bugs but trust-boundary failures at SaaS integration points, such as OAuth scopes and third-party permissions. These vulnerabilities are less protected by traditional defensive measures like ASLR or stack canaries, and AI can surface and exploit them with even less mature tooling.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Cybersecurity Analyst Coffee Mug – Vulnerability Scanner by Day Ninja by Night – 11 oz White Ceramic – Bold Design
BOLD CYBERSECURITY DESIGN: Features the phrase 'Vulnerability Scanner by Day Ninja by Night' with striking alert icons and…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
AI-powered code analysis tool
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
software patch management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
network security monitoring device
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disrupted 90-Day Disclosure Model
This shift fundamentally alters the cybersecurity landscape. The traditional model, which relied on a 90-day window for defenders to patch before attackers could exploit, is no longer valid. AI enables attackers to develop and deploy exploits immediately after patches are public, increasing the risk of widespread, rapid attacks. The focus is shifting from memory-safety bugs to trust boundary failures, which are less protected and harder to defend against. This change demands new strategies for vulnerability management, emphasizing real-time monitoring and AI-driven defenses.
Evolving Security Paradigms in the Age of AI
The responsible disclosure framework has been the backbone of cybersecurity for over two decades, predicated on the assumption that patches take time to analyze and exploit development takes days or weeks. The 90-day window, popularized by Google Project Zero in 2014, was designed to balance researcher incentives and vendor patching timelines. Recent technological advances, especially AI-driven code analysis, have shattered these assumptions. The capabilities demonstrated by Theori’s AI and the recent high-profile breaches at Vercel and Canvas highlight a shift towards vulnerabilities at SaaS and trust boundaries, which are less protected by traditional security measures.
Historically, attackers relied on reverse engineering and exploit-mitigation bypass techniques, requiring years of expertise. Now, AI models trained on code and patches can generate exploits in minutes, making the old apprenticeship model obsolete and broadening the attacker base to less skilled actors.
“The 90-day window is no longer a defender’s advantage; AI enables exploits to be developed immediately after patches are public.”
— Thorsten Meyer
Unclear Impact of Immediate Exploit Development
It remains uncertain how quickly widespread exploitation will occur at scale, given the evolving defensive measures and the varying maturity of AI tools across attacker groups. Additionally, the full extent of the impact on different sectors, especially those relying heavily on SaaS and cloud services, is still emerging. While the technical capabilities are clear, the practical deployment and coordination of large-scale attacks are still developing.
Next Steps for Security Stakeholders in a Rapid-Exploit Era
Security teams will need to adopt real-time monitoring powered by AI to detect and respond to exploits immediately after patches are released. Vendors may need to accelerate patching cycles and improve transparency around security updates. Policymakers and industry groups could consider revising disclosure norms or developing new frameworks suited to AI-driven vulnerabilities. Further research into AI-resistant security measures and proactive defenses is expected to become a priority in the coming months.
Key Questions
Why is the 90-day disclosure window no longer effective?
Because AI tools can analyze patches and develop exploits within minutes, eliminating the traditional window that allowed defenders to patch before attackers could exploit vulnerabilities.
What vulnerabilities are most affected by this change?
Trust boundary failures at SaaS interfaces, OAuth scopes, and third-party integrations are now the most critical, as they are less protected by memory-safety defenses and are more susceptible to AI-driven discovery.
How are attackers leveraging AI in cybersecurity?
Attackers use AI to analyze code diffs, identify vulnerabilities, and generate working exploits rapidly, often before patches are widely deployed or even publicly disclosed.
What should organizations do to protect themselves?
Organizations should implement real-time, AI-powered monitoring, accelerate patching processes, and focus on securing trust boundaries and third-party integrations to mitigate emerging risks.
Source: ThorstenMeyerAI.com
