Project Zero declares 90-day security fixes obsolete in the AI era

Google's elite Project Zero security research team has declared its long-standing 90-day vulnerability disclosure policy obsolete, citing fundamental shifts in the threat landscape driven by AI. The team reports that LLMs enable attackers to discover and exploit vulnerabilities at unprecedented speed, and can reverse-engineer patches almost instantly, making traditional 'patch soak time' meaningless.

The new 'Full X' policy framework represents a major philosophical shift in how security researchers will pressure vendors. With AI tools helping Project Zero find 'several vulnerabilities a week' in targets that previously yielded 'a few vulnerabilities a year,' the team is moving toward automated disclosure timelines designed to force vendors toward faster remediation and reduced 'patch gap'—the critical window between patch release and user installation. This announcement signals the end of the comfortable 120-day remediation cycle as the security industry grapples with AI-powered offense.