Google Project Zero Cuts Vulnerability Disclosure Window to 90 Days

1 reports archived1 independent sourcesupdated 11/14/2026, 19:13:17

Synthesis & Latest Updates

1 Sources Cross-Validated

Google Project Zero is scrapping its '90+30' disclosure policy and will publish vulnerability details 90 days after reporting. The team says AI-assisted vulnerability discovery and exploitation have compressed attacker timelines so much that patch soak time is no longer meaningful, forcing vendors to remediate faster.

LATEST/Google Project Zero is scrapping its '90+30' disclosure policy and will publish vulnerability details 90 days after reporting. The team says AI-assisted vulnerability discovery and exploitation have compressed attacker timelines so much that patch soak time is no longer meaningful, forcing vendors to remediate faster.

Hourly heat curve

10 fully observed hours

Now

13.8

Peak

16.720:00

24h change

–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first

Hacker News AIT2Nov 14, 19:13·72 pts
Google Project Zero Cuts Vulnerability Disclosure Window to 90 Days
- Project Zero drops the extra 30-day patch soak period, disclosing details 90 days after reporting
- LLMs accelerate vulnerability discovery, exploitation, and patch-to-exploit reverse engineering
- Zero patch-to-exploitation time is now treated as a reasonable attacker behavior model, shrinking vendor remediation windows
View Related Reports & Analysis Original Source