Policy and Disclosure: 2026 Edition (projectzero.google)

Project Zero has announced a significant update to its vulnerability disclosure policy in response to the changing threat landscape driven by AI-assisted vulnerability discovery and exploitation. Previously, the “90 + 30” timeline allowed vendors up to 120 days to remediate vulnerabilities, but this is now deemed insufficient as large language models (LLMs) have accelerated the pace at which attackers can identify and exploit security flaws. The revamped policy, dubbed “Full X,” will progressively shorten the disclosure period from 90 days to 30 days by January 2028, aiming to encourage faster vulnerability remediation and reduce the “patch gap”—the critical time between when a vulnerability is fixed and when users actually apply the patch. This shift is significant for the AI/ML community as it emphasizes the need for rapid response mechanisms in an era where traditional timelines are inadequate. Project Zero's acknowledgment that the detection and exploitation of vulnerabilities have become almost instantaneous highlights the urgency for vendors to enhance their remediation processes. By streamlining the disclosure process and minimizing exceptions, the new policy aims to protect users more effectively against emerging threats, thus fostering a proactive approach to security that acknowledges the realities of modern exploitation techniques.