📊 Full opportunity report: The 90-Day Window Closed. Nobody Sent a Notice. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
The 90-day coordinated disclosure period for a recent Linux kernel vulnerability has ended without any vendor notices or patches. Experts warn this shift favors attackers, as AI tools can now exploit vulnerabilities faster than defenders can respond.
The 90-day period for coordinated disclosure of a critical Linux kernel vulnerability has officially closed without any vendor notices or patches, marking a significant shift in cybersecurity dynamics.
On April 1, 2026, a Linux kernel patch addressing the Copy Fail vulnerability was committed publicly. Despite this, no official notices or patches have been issued by the Linux kernel maintainers or affected vendors as of now, surpassing the 90-day disclosure window.
Security experts warn that AI-driven systems can now monitor kernel commits, analyze patches, and develop exploits within minutes, effectively eroding the traditional defensive advantage that the 90-day window was designed to provide. This development suggests that attackers can weaponize vulnerabilities almost immediately after they are publicly disclosed or even before.
Recent incidents, including breaches at Vercel (April 19) and Canvas (May 1), underscore a shift toward vulnerabilities rooted in trust boundaries and integration points rather than memory safety, complicating defense strategies further.
The 90-day window closed.
Nobody sent a notice.
The commit-monitoring window. The knowledge floor. And what Vercel and Canvas reveal about where the bugs actually live.
Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between commit and disclosure are the dangerous window — AI can rediscover the bug from the diff in minutes, while distribution patches take 2-8 weeks to reach end-user systems. Three asymmetries compound: time, expertise, knowledge category. Defender disadvantage compounds across all three.
The patch is now the disclosure event.
Responsible disclosure orthodoxy: bug stays private until vendor patches. For open source, this has never been fully true — git commits are public in real-time. Copy Fail’s mainline patch landed April 1. Public disclosure was April 29. The 28 days between are the dangerous window.
fafe0fa2995a reverting the 2017 in-place AEAD optimization. Patch is now public.INSTANT
TREES
PUBLIC
AVAILABLE
SLOWLY
Networks Attacks and Defense; Tools and Resources
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“Please find a security vulnerability.”
No training required.
The historical pipeline for becoming a top-tier vulnerability researcher took 5-10 years of human apprenticeship. Kernel internals. Processor architecture. Exploit-mitigation-bypass craft. Decompiler-output reading. All baked into frontier model training data.
- CS degree with security specialization
- 3-5 years red team / CTF / firm experience
- 2-3 years senior research with reportable findings
- Tacit knowledge: kernel internals, decompiler output reading, exploit-mitigation-bypass craft
- Global pool: ~200-500 senior researchers per decade
- Apprenticeship: mentored by existing experts
- Frontier model API access ($20-200/month for individuals)
- One prompt: “Please find a security vulnerability”
- No security training required (Anthropic / AISI / CETaS verified)
- Tacit knowledge baked in from model training
- Pool of capable actors: millions globally
- Bottleneck: willingness to use it, not skill
The prompt Anthropic used to discover vulnerabilities with Mythos “essentially amounted to ‘Please find a security vulnerability in this program.'” Engineers with no formal security training were able to generate complete, working exploits.
Security Patch Management
Used Book in Good Condition
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Memory safety isn’t where the breaches happen anymore.
Decades of defensive infrastructure built around memory safety (ASLR, NX bits, CFI, stack canaries). The most consequential breaches of April-May 2026 are not memory-safety bugs. They are trust-boundary failures at integration seams.
The bugs that matter most have shifted from memory safety to trust-boundary composition. OAuth scopes. SaaS-to-SaaS authentication. Multi-tier account models. Third-party app permissions. Environment variable handling. Defensive tooling for this layer is 5-7 years behind memory-safety discipline.
Defensive infrastructure for memory safety is 25+ years mature. Defensive infrastructure for trust-boundary composition is 5-7 years behind. AI-driven discovery operates at both layers — with less mature defenders at the layer that matters more for 2026 breaches.
Advanced Cyber Threat Intelligence and Hunting: Detect APTs and zero-day attacks using CTI, behavioral analytics, and AI techniques
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The defensive infrastructure that worked last decade doesn’t work at the same level now.
Adaptation is necessary. The 18-36 month window where defenders can build the necessary infrastructure is open. Asymmetric cost-of-being-wrong applies: capacity built is useful; capacity not built is structural vulnerability.
+ SECURITY TEAMS
PUBLISHERS
POLICYMAKERS
EVERYONE ELSE
The 90-day window collapsed. The knowledge floor collapsed. The bugs moved layers. Three asymmetries compound. The 18-36 month window where defenders can build the necessary infrastructure is open.
Applied Network Security Monitoring: Collection, Detection, and Analysis
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Implications of the Disappearing Defense Window
The expiration of the 90-day disclosure window without vendor response fundamentally alters cybersecurity risk management. It shifts the advantage from defenders to attackers, as AI tools can now rapidly identify, analyze, and exploit vulnerabilities, leaving traditional patching cycles inadequate. This change increases the urgency for organizations to adopt proactive security measures and rethink reliance on delayed disclosures.
Evolving Threat Landscape and Past Practices
Since the early 2000s, the responsible disclosure framework relied on a 90-day window, allowing vendors time to patch vulnerabilities before they became publicly exploitable. This approach was predicated on the assumption that reverse engineering patches and developing exploits required significant time and skill.
However, recent breakthroughs in AI, exemplified by systems like Theori’s Xint Code and Anthropic’s Mythos, have drastically reduced the time needed for vulnerability discovery and exploitation. The Linux kernel commit for Copy Fail was publicly available on April 1, 2026, and within days, AI systems could reconstruct exploits, as confirmed by security researchers. This has rendered the traditional 90-day window obsolete.
Furthermore, recent breaches at Vercel and Canvas reveal that the most critical vulnerabilities are now often at trust boundaries—OAuth scopes, SaaS integrations, environment variables—areas where traditional defenses like memory safety protections do not apply.
“The 90-day window, once a defender’s advantage, is now effectively a vulnerability window for attackers due to AI-driven exploit development.”
— Thorsten Meyer
Remaining Unknowns and Developing Risks
It is still unclear how quickly vendors will respond to this shift or adapt their patching and disclosure processes. The extent to which AI can develop fully weaponized exploits before patches are deployed remains a subject of ongoing observation. Additionally, the long-term impact on the cybersecurity ecosystem and how organizations will need to adjust their defenses is still emerging.
Next Steps for Security and Policy Adaptation
Security professionals and organizations must reassess their vulnerability management strategies, emphasizing proactive monitoring and AI-driven defenses. Vendors are likely to revisit disclosure policies, possibly moving toward real-time or continuous patching models. Further research is needed to understand the full scope of AI’s role in both offensive and defensive cybersecurity operations over the coming months.
Key Questions
Why did the vendor not issue a notice after the 90-day window?
It is not yet clear why vendors have not issued notices or patches. Possible reasons include strategic delays, resource constraints, or a recognition that traditional patching cycles are no longer effective against AI-facilitated exploits.
What does this mean for organizations relying on patch cycles?
Organizations may need to adopt more proactive, AI-enabled monitoring systems and rethink reliance on delayed patching, as vulnerabilities can be exploited almost immediately after disclosure or even beforehand.
Are all vulnerabilities now at risk of rapid exploitation?
Not necessarily all, but vulnerabilities at trust boundaries and integration points are increasingly susceptible, especially as AI tools can analyze and exploit these weaknesses faster than traditional methods.
Will this change how responsible disclosure works in the future?
It is likely that disclosure practices will evolve, potentially moving toward real-time updates or continuous patching models to counteract the rapid pace of AI-driven exploitation.
Source: ThorstenMeyerAI.com
