📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The traditional 90-day window for vulnerability disclosure has closed without any notices from vendors or researchers. This development highlights shifts in cybersecurity practices and risks, driven by AI-enabled exploit discovery.
The 90-day window for responsible disclosure of a major Linux kernel vulnerability, known as Copy Fail, has closed without any notices or patches from vendors or researchers, signaling a shift in cybersecurity dynamics.
Traditionally, the 90-day coordinated disclosure window was designed to give vendors time to develop patches while allowing researchers to publicly disclose vulnerabilities after a set period. However, in 2026, this window has effectively become a vulnerability itself, as AI-driven tools enable attackers to discover and exploit bugs within days of their public disclosure or even before patches are released.
The Linux kernel patch for Copy Fail was committed on April 1, 2026, and publicly disclosed on April 29. During the four-week window, AI systems monitoring kernel commits could have reconstructed the exploit in minutes, not days, potentially allowing malicious actors to weaponize the vulnerability before any official patch or notice was issued. No notices or patches have been sent by vendors or researchers since the window closed, raising questions about the future of responsible disclosure practices.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Security Monitoring with Wazuh: A hands-on guide to effective enterprise security using real-life use cases in Wazuh
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
SMP/E Made Simple: A Beginner’s Guide to z/OS System Maintenance (IBM Mainframe Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
AI In Cybersecurity: Simplifying Cyber Risk with Smart, Affordable Tools for Small Business Defense
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Applied Network Security Monitoring: Collection, Detection, and Analysis
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disclosed Window Closure
This shift undermines the core premise of the responsible disclosure model, which relied on a period of coordinated patching and notification to defend systems. AI’s ability to rapidly analyze commits and develop exploits means attackers can act almost immediately, reducing the window for defenders to respond. The collapse of this protective buffer increases the risk of widespread exploitation, especially as vulnerabilities move from kernel memory safety bugs to trust boundary failures at application and service layers.
Evolving Cybersecurity Landscape and Disclosure Practices
Since the early 2000s, the 90-day disclosure window has been a cornerstone of cybersecurity, balancing the interests of researchers and vendors. However, recent advances in AI, such as Theori’s inference capabilities and tools like Xint Code, have drastically shortened the time required for exploit development. Notably, the Linux kernel’s Copy Fail vulnerability was publicly disclosed in late April 2026, after being patched in early April, but the window for malicious discovery was effectively open from the moment of commit due to AI monitoring.
Recent incidents, including breaches at Vercel (April 19) and Canvas (May 1-12), demonstrate that the most critical vulnerabilities now lie in trust boundaries—OAuth scopes, SaaS integrations, environment variables—rather than traditional memory safety flaws. This evolution signifies a fundamental change in attack vectors and defensive strategies.
“AI-driven discovery fundamentally alters the timing and nature of vulnerability exploitation, rendering previous defensive assumptions obsolete.”
— Thorsten Meyer
Unresolved Questions About Future Disclosure Models
It remains unclear whether new frameworks will emerge to replace or supplement the traditional 90-day window, or if the industry will accept a higher level of risk with no formal disclosure period. The effectiveness of existing mitigation strategies against AI-driven exploits is also still being evaluated.
Next Steps for Cybersecurity Stakeholders
Vendors, researchers, and policymakers are likely to revisit disclosure policies, possibly adopting more rapid or continuous patching models. Monitoring of AI tools for exploit detection will become increasingly critical. Further case studies, including the ongoing impact of recent breaches, will inform future defensive strategies and regulatory approaches.
Key Questions
Why did the 90-day window close without any notices?
The window closed without notices because AI-enabled tools allow attackers to discover and exploit vulnerabilities almost immediately, making the traditional timing model obsolete.
What are the risks of not issuing notices or patches?
Without timely notices or patches, vulnerabilities remain unaddressed, increasing the likelihood of widespread, rapid exploitation by malicious actors.
How does AI change the vulnerability discovery process?
AI accelerates the analysis of code commits and the development of exploits, reducing the discovery-to-weaponization timeline from weeks or months to minutes or days.
Are there any new disclosure policies being considered?
It is still uncertain whether the industry will adopt new models, such as continuous or real-time disclosures, to better manage AI-driven exploit risks.
Source: ThorstenMeyerAI.com
