AI exploits patches in 30 minutes breaking 90-day disclosure
ai models reverse-engineer security patches into exploits in 30 minutes, rendering the traditional 90-day vulnerability disclosure window obsolete according to cloudflare analyst himanshu anand.
security expert himanshu anand released a detailed analysis demonstrating that ai language models have collapsed the timeline for cyber defense, allowing attackers to turn patches into working exploits in roughly 30 minutes. this speed destroys the 'safety net' of the traditional 90-day disclosure window popularized by google project zero, which assumed vendors had a head start and that reverse engineering took weeks. anand provides evidence from recent incidents involving react and the linux kernel where independent researchers using ai tools found identical flaws simultaneously or bypassed embargoes, resulting in active exploitation before patches were ready. to address this shift, anand recommends that vendors treat critical bugs as emergencies, researchers drastically shorten disclosure timelines, and administrators deploy patches instantly to prevent system compromise.