Project Zero overhauls disclosure policy: AI made the 90+30-day timeline insufficient
ifsecure · x · 2026-11-14
Google Project Zero updates its 2021-era "90+30" vulnerability disclosure policy. Key arguments: LLMs have dramatically sped up vulnerability discovery and exploitation, raising the risk of multiple parties finding the same bug; patch soak time is meaningless now that attackers can reverse-engineer bugs from patches almost instantly, making zero patch-to-exploitation time a reasonable attacker model. AI has also multiplied Project Zero's findings — from a few per year to several per week — so vendors must patch faster and shrink patch gaps.
More from AGI Musings
- Frontier models will first emulate how scientists reason, not simulate biology — kenbwork · 2026-11-14
- Two Claude instances left to chat freely drift into consciousness talk, greet in Sanskrit — kevtargaryen93 · 2026-11-14
- As AI makes intelligence abundant, trust-based industries stay valuable — RaphaelDabadie · 2026-11-14
- OpenAI board member Paul Cristiano: AI accidents are the most likely cause of your death — Ars Technica AI · 2026-11-14
- One snack question cuts job applications by 60% as AI-generated replies exposed — jwt0625 · 2026-11-14
- Breaking up AI labs wouldn't hurt: Standard Oil split tripled Rockefeller's fortune to $900M — krishnan · 2026-11-14