AI is finding security bugs faster than maintainers can fix them. Should the 90-day disclosure deadline change?
Jump to a position (4)
What this question is about
When security researchers find a vulnerability, they usually tell the project privately and publish the details 90 days later, or sooner once a fix is out. Google's Project Zero made this deadline the common standard. It exists to push vendors to fix bugs instead of sitting on them.
In 2026 AI models began finding bugs at a scale nobody planned for. Published CVEs roughly doubled in a year, PostgreSQL delayed its release to keep up with fixes, and many reports land on projects run by volunteers. The same tools can also help attackers. The question is whether 90 days still protects users, and if not, which way the deadline should move.
Positions
4 positions, in no order of merit. Open one for its full case.
Researchers keep giving projects 90 days to fix a reported bug before details are published, as Project Zero and most of the industry do today.
3 reasons4 sources3 objections from other positions
A fixed deadline is what makes vendors fix bugs at all; before it, reported flaws could sit unpatched for years.
Strongest objection (Leaves something out), for Give maintainers more time: Volunteer projects like FFmpeg aren’t vendors stalling; they simply don’t have the people to fix a flood of reports in any deadline.
Projects, especially volunteer ones, get longer or flexible deadlines, and finders slow the pace of their reports to what a project can handle.
2 reasons5 sources2 objections from other positions
Maintainers can’t keep up: PostgreSQL delayed its whole release because fixing AI-found bugs swallowed its reviewers’ time.
Strongest objection (Leaves something out), for Shorten the deadline: Attackers won’t slow down to match a project’s capacity, so a longer embargo mainly keeps users in the dark.
The deadline stays, but companies that report bugs at scale with AI also have to supply tested patches or pay for the work of fixing them.
3 reasons3 sources2 objections from other positions
Finding bugs has far outrun fixing them, so the bottleneck is the fixing, not the deadline.
Strongest objection (Leaves something out): Several AI companies are already paying: seven of them gave $12.5 million through the Linux Foundation for triage and fixes.
Disclosure deadlines get shorter, so users learn about flaws sooner, even if some are published before a fix exists.
2 reasons2 sources4 objections from other positions
Attackers have the same AI tools, so a bug one company finds is likely to be found by someone else long before 90 days pass.
Strongest objection (Overstated), for Keep 90 days: No attacks on CVE-2026-98432 had been reported even after its exploit was announced, so real attackers are still slower than the theory.
Where do you stand?
Which position comes closest to your view? “Not sure yet” is a fine answer too, and you can change it any time.
Open questions
Where this page still needs help. Each one takes a few minutes.
Show 2 open questionsHide open questions
- Add a source
No source yet · Keep the deadline, make the finders fix it
A company that can find a bug with AI in minutes is also the one best placed to write and test the fix.
- Add a source
No source yet · Keep 90 days
Everyone already knows the 90-day rule, so changing it would create confusion exactly when the volume of reports is highest.
Is a position missing?
Propose a positionSource trail
- Cyber Security News: Google Project Zero changes its vulnerability disclosure policycybersecuritynews.com
- It’s FOSS: FFmpeg calls Google’s AI bug reports “CVE slop”itsfoss.com
- Atlantic Council: New AI models are pushing open-source security to its limits. Their developers must step up.atlanticcouncil.org
- Cisco Talos: There’s only so much code: the rise in vulnerability numbersblog.talosintelligence.com
- Hardware Busters: PostgreSQL 19 slips to November 19 as AI-found bugs swamp its human reviewershwbusters.com
More in Technology and AI
Most read and most researched
- Most read · 13 sourcesShould veganism be more widely adopted?
- Most researched · 22 sourcesWhich AI company is the most ethical?
Log in to propose a position, add evidence, or object to a weak point.