📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.

The 90-day coordinated disclosure window, a cornerstone of cybersecurity practices since the early 2000s, has officially closed without any notices or patches from affected vendors, marking a significant shift in vulnerability management.

On April 1, 2026, a critical Linux kernel vulnerability known as Copy Fail was patched in the mainline kernel. Despite the patch being publicly available from that date, no vendor or affected organization issued a security notice or deployed a patch within the subsequent 28 days, which ended on April 29, 2026.

This absence of notices is notable because the traditional 90-day window was designed to give defenders time to respond while limiting attacker opportunities. The delay or absence of vendor disclosures suggests a fundamental change in how vulnerabilities are managed, especially with AI-driven tools capable of rapidly analyzing patches and developing exploits.

Security researchers and industry observers are now questioning whether the responsible disclosure model remains effective in its current form, given the accelerated pace of vulnerability discovery and exploit development facilitated by AI technologies.

Implications of the Disclosed Window Closure

The expiration of the 90-day window without vendor notices indicates a potential shift where attackers may gain an advantage over defenders. The traditional model relied on the assumption that patches would be deployed promptly, and that the window between patch release and exploitation was manageable.

With AI systems capable of monitoring commits, reverse-engineering patches in minutes, and developing exploits rapidly, the period of vulnerability has effectively shortened to zero. This could lead to more widespread, faster exploitation of vulnerabilities, especially in critical infrastructure and cloud services.

Furthermore, the lack of vendor disclosures raises concerns about transparency and accountability, as organizations may remain unaware of vulnerabilities until they are exploited in the wild, increasing risk exposure across sectors.

Evolving Practices in Vulnerability Disclosure

The responsible disclosure framework was established over two decades ago to balance the interests of researchers and vendors, with the 90-day window serving as a negotiated compromise. It was predicated on assumptions that no longer hold in 2026.

Recent high-profile breaches, such as those involving Vercel and Canvas, demonstrate that many of the most critical vulnerabilities today are not memory-safety bugs but trust boundary failures at integration points like OAuth scopes and SaaS-to-SaaS communication. These vulnerabilities often remain undetected by traditional security measures and are exploited rapidly once discovered.

Meanwhile, AI-driven discovery tools, like those used by Theori and Anthropic, can surface zero-day vulnerabilities and develop exploits within minutes of a patch being released, rendering the traditional 90-day window obsolete.

“The collapse of the knowledge floor and the rapid development of exploits by AI tools mean the traditional 90-day window is no longer a defender’s advantage.”

— Thorsten Meyer

Unclear Impact on Future Security Practices

It remains uncertain whether vendors will begin to adopt more proactive disclosure or if new frameworks will emerge to address the accelerated pace of vulnerability discovery driven by AI. The long-term implications for cybersecurity policy and industry standards are still developing.

Next Steps for Vulnerability Management and Policy

Security industry leaders and policymakers are likely to reevaluate disclosure standards, possibly moving toward more transparent or real-time notification systems. Organizations should prepare for faster threat timelines and consider adopting AI-based monitoring tools to identify vulnerabilities proactively.

Further research and discussion are expected to clarify how to balance responsible disclosure with the realities of AI-enabled exploitation, shaping the future of cybersecurity protocols.

Key Questions

What does the end of the 90-day window mean for cybersecurity?

It suggests that vulnerabilities could be exploited more rapidly after discovery, reducing the time defenders have to respond and patch, especially as AI tools accelerate exploit development.

Why have vendors not issued notices for the recent Linux kernel patch?

It is not yet clear whether vendors are intentionally withholding notices, are unaware of the implications, or are reevaluating their disclosure strategies in light of AI-driven attack capabilities.

How does AI change the landscape of vulnerability discovery?

AI can analyze patches, reverse-engineer vulnerabilities, and develop exploits within minutes, collapsing traditional windows of opportunity for defenders.

Will the responsible disclosure model be replaced?

It is uncertain. Industry experts are debating whether new models or regulations are needed to address the accelerated pace of vulnerability discovery and exploitation.

What should organizations do now?

Organizations should enhance their monitoring capabilities, adopt AI-driven security tools, and prepare for faster response times to emerging vulnerabilities.

Source: ThorstenMeyerAI.com