---
title: "the 90 day disclosure policy is dead"
url: https://daily.dev/posts/the-90-day-disclosure-policy-is-dead-gnbby7qsj
source_url: https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead
type: article
source: "Lobsters"
published: 2026-05-11T05:48:38.365Z
updated: 2026-05-11T05:49:04.299Z
tags: ["security", "cyber", "linux", "llm"]
reading_time: 15
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# the 90 day disclosure policy is dead

**[Lobsters](https://daily.dev/sources/lobsters)** · 15 min read · 1 upvotes · 0 comments

## Summary

LLMs have fundamentally broken the assumptions behind the 90-day responsible disclosure model. With AI-assisted tools, multiple unrelated researchers now independently find the same critical bugs within weeks, and patch diffs can be reverse-engineered into working exploits in under 30 minutes. Three real-world examples illustrate this: 11 researchers independently reported the same payment bypass bug in 6 weeks; a React security patch was turned into a working exploit in 30 minutes using AI; and two back-to-back Linux kernel privilege escalation vulnerabilities (Copy Fail and Dirty Frag) were weaponized by nation-state actors within days of disclosure, with Dirty Frag's embargo broken within hours. The author argues that 90-day windows, monthly patch cycles, and advisory-based response are all obsolete. The call to action: treat every critical bug as P0, fix immediately, and integrate AI into CI/CD pipelines for real-time security review, patch analysis, and dependency scanning on the defensive side.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead>

## Similar posts on daily.dev

- [AI is Breaking Two Vulnerability Cultures](https://daily.dev/posts/ai-is-breaking-two-vulnerability-cultures-icjk4gfak) · Hacker News · 1 upvotes · 0 comments
- [Did AI Just Break Software Security For Ever?](https://daily.dev/posts/did-ai-just-break-software-security-for-ever--6pxwdikky) · Foojay.io · 0 upvotes · 0 comments
- [From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle](https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s) · Security Boulevard · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#llm](https://daily.dev/tags/llm)

[View this post on daily.dev](https://daily.dev/posts/the-90-day-disclosure-policy-is-dead-gnbby7qsj)