The Extended Brief

Policy and Disclosure: 2026 Edition

Brief by The AI News AI newsroom · Nov 13, 2026, 1:11 PM EST edition

Original reporting by Google Project Zero — Natalie Silvanovich · published Nov 13, 2026, 3:00 AM EST

AI-assisted exploitation has made Project Zero's 90-day disclosure window obsolete, so vendors must remediate bugs and deliver patches far faster to keep users safe.

Key points

• Project Zero says its 90-day remediation window is now clearly insufficient because LLMs accelerate vulnerability discovery and exploitation. source ↗
• Since 2021, the policy gave vendors 90 days to fix a bug plus 30 days of patch rollout soak time. source ↗
• Project Zero treats near-zero patch-to-exploitation time as a reasonable, though imperfect, model of attacker behavior. source ↗
• The team now finds several vulnerabilities a week in targets where it once found a few per year. source ↗
• Project Zero urges vendors to shrink the patch gap between a fix's release and users installing the update. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Vendor security teams should audit their end-to-end fix pipeline now, since Project Zero is pressing for remediation well inside the old 90-day norm.
• Ship interim protections such as feature flags, configuration changes, or server-side mitigations so users are covered while a full patch is still in progress.
• Measure your own patch gap from fix release to user install, and invest in faster update delivery channels to close it.
• Teams that rely on coordinated disclosure should prepare for less negotiation over fix confirmation and grace periods, which Project Zero calls unmanageable at current bug volume.

Context

Project Zero is Google's in-house security research team, and coordinated disclosure policies give vendors a fixed window to patch bugs before researchers publish details. Since 2021 that window was 90 days plus a 30-day patch soak period. The team argues LLM tooling has collapsed both bug-discovery and patch-reverse-engineering times, forcing a policy rethink.

What to watch

• The specific deadlines and terms of the revised policy, which the post was announcing as it cut off.
• Whether major vendors publicly commit to faster remediation or resist shorter disclosure windows.

Related briefs

• 56 AWS API calls in 141 milliseconds: Inside an AI-run intrusion
• Fireworks AI security breach impacts Notion and their customers
• The gap between open and closed AI models in cyber capabilities keeps shrinking
• A $90 Key into Your Company's Secrets

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.