AI turns patches into working exploits in 30 minutes, and the 90-day disclosure window is the casualty

Editor's take

AI models are now capable of identifying vulnerabilities in software and generating functional exploits from existing patches in under an hour, significantly compressing the timeline for security researchers. This rapid acceleration threatens the traditional 90-day vulnerability disclosure window, a cornerstone of cybersecurity for decades. The reduced timeframe leaves less time for vendors like Microsoft or Apple to remediate flaws before they can be weaponized by malicious actors, potentially increasing the attack surface for millions of users.

The implications are far-reaching, affecting software developers, cybersecurity firms, and end-users alike. Established security practices, including bug bounty programs and responsible disclosure policies, may require substantial re-evaluation. The speed at which these AI-powered tools can operate suggests a potential arms race where defenders struggle to keep pace with increasingly sophisticated offensive capabilities.

Future developments to monitor include the emergence of specialized AI for exploit generation and the industry's response to this accelerated threat landscape. Specifically, it will be crucial to observe whether vendors adopt faster patching cycles or if new disclosure frameworks, perhaps involving real-time reporting or automated remediation, gain traction. The efficacy of current AI detection tools against these new exploit generation methods will also be a key indicator.