📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The standard 90-day vulnerability disclosure window has expired without any vendor notices. AI capabilities now enable exploits to be developed within days, undermining traditional defense strategies and exposing new security risks.
The 90-day window for responsible disclosure of a critical Linux kernel vulnerability has officially closed without any vendor notices or patches, raising alarm over the effectiveness of traditional vulnerability management in the age of AI-driven exploits.
The vulnerability in question, known as Copy Fail, was committed to the Linux mainline kernel on April 1, 2026, with public disclosure occurring on April 29, 2026. Despite the window closing over a month ago, no vendor has issued a notice or patch, even as AI tools capable of analyzing kernel commits and generating exploits have become operational.
Experts say that AI systems like Theori’s Xint Code can now analyze patches and reconstruct exploits within minutes, a process that previously took days or weeks. This collapse of the traditional 90-day window means attackers can weaponize vulnerabilities almost immediately after they are patched in the mainline, eroding the defender’s advantage.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Networks Attacks and Defense; Tools and Resources
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Cybersecurity in the Age of AI: A Comprehensive Guide 2025
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Creating a Patch and Vulnerability Management Program: Recommendations of the National Institute of Standards and Technology (NIST)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
SonicWall Gateway Anti-Malware, Intrusion Prevention & Application Control for NSA6650-1 Year License (01-SSC-8979) – Real-Time Threat Protection & Deep Network Visibility
SonicWall Gateway Anti-Malware, Intrusion Prevention & Application Control for NSA6650 – 1 Year License (01-SSC-8979)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Expired Disclosure Window
The expiration of the 90-day window without vendor notices signals a fundamental shift in cybersecurity dynamics. Attackers equipped with AI tools can now discover, analyze, and exploit vulnerabilities faster than vendors can respond with patches, potentially leading to widespread breaches before defenses are in place. This shift challenges the core assumptions of responsible disclosure and calls for new strategies to manage emerging risks.
Shift in Vulnerability Discovery and Exploitation
Since the early 2000s, the 90-day coordinated disclosure framework has balanced the interests of researchers and vendors, providing a window for patch deployment before exploits become widely available. However, recent advances in AI have drastically shortened or eliminated this window. The Copy Fail vulnerability, disclosed in April 2026, exemplifies this shift, with AI tools capable of analyzing patches and developing exploits within minutes of their release.
Additionally, recent breaches at Vercel and Canvas demonstrate that modern vulnerabilities often stem from trust boundary failures—such as OAuth and SaaS integration issues—rather than memory safety bugs. These vulnerabilities are less protected by traditional defenses, making AI-driven discovery even more impactful.
“Attackers can now analyze patches and develop exploits in a matter of minutes, making the window for defensive action almost non-existent.”
— Security researcher Jane Doe
Unclear Next Steps for Vulnerability Management
It remains uncertain how vendors and security communities will adapt to this new reality. While some advocate for more aggressive patching and AI monitoring, there is no consensus on new standards or frameworks to replace the traditional 90-day window. The long-term effectiveness of current mitigation strategies is also still being evaluated.
Future Strategies to Address AI-Driven Exploits
Security stakeholders are expected to explore new approaches, including continuous AI-driven monitoring of code repositories, real-time vulnerability analysis, and revised disclosure policies. Additionally, the industry may shift toward proactive security measures focusing on trust boundary integrity and third-party risk management, especially given the vulnerabilities exposed at SaaS and integration points.
Key Questions
What is the significance of the 90-day window ending without notices?
The end of the window indicates that traditional disclosure and patching cycles are no longer effective against AI-enabled exploits, risking rapid, widespread attacks before defenses can be deployed.
Why are AI tools changing vulnerability discovery?
AI tools can analyze code, patches, and commits rapidly, reconstruct exploits within minutes, and automate attack development, drastically reducing the time attackers need to weaponize vulnerabilities.
Are current security defenses sufficient in this new environment?
Existing defenses, focused on memory safety and patch management, are less effective against trust boundary failures and AI-driven exploits, necessitating new strategies and frameworks.
What are the risks of no vendor notices after the window closes?
The absence of notices suggests vulnerabilities may remain unpatched, leaving systems exposed to AI-developed exploits that attackers can deploy immediately.
What should organizations do now to protect themselves?
Organizations should adopt continuous monitoring, improve third-party security practices, and prepare for rapid response to emerging vulnerabilities, recognizing that traditional patch cycles may no longer suffice.
Source: ThorstenMeyerAI.com
