Google Project Zero revisits its 90 + 30 disclosure policy over AI-driven attacks

Google Project Zero has published a post on its vulnerability disclosure policy for 2026. Since 2021 the team has followed a "90 + 30" approach: vendors get up to 90 days to fix a flaw, plus 30 extra days of "soak time" for customers to roll out the patch. ^[1]

Project Zero says the policy was meant to push vendors toward quicker fixes and leave room for patches to reach users. It now concludes that AI-assisted bug hunting and exploit development has shifted the threat landscape, so the schedule the policy sets is clearly too slow. ^[1]

The team points to large language models as the reason attackers can now find and exploit flaws faster. The excerpt available does not detail the new policy terms. ^[1]