Project Zero will disclose vulnerabilities 90 days after reporting

Google's Project Zero will now publish the details of the vulnerabilities it reports a fixed number of days after reporting them, with a few stated exceptions, whether or not the vendor has fixed the bug, and that number will shrink. Under the policy announced on November 13, 2026, called "Full X," the deadline starts at 90 days, falls to 60 on February 2, 2027 and to 30 on January 3, 2028, according to Project Zero's announcement by Natalie Silvanovich. Since 2021 the team had used "90 + 30": vendors got up to 90 days to fix a bug plus 30 more days of "soak time" to roll the patch out to users.

The stated reason is large language models. Project Zero says LLMs let attackers find and exploit bugs faster, raise the chance that several parties, including malicious ones, find the same bug, and shorten the time needed to work out a vulnerability from its patch. It now treats zero time between a patch and its exploitation as a reasonable, though imperfect, model of attacker behavior. If attackers can read a bug's details from the fix almost immediately, a quiet period after release protects little and can put users at risk by creating a false sense of secrecy. The risk that remains is the patch gap, which Project Zero defines as the time between a fix being released and a user installing it. It asks vendors to shorten that gap by rolling out fixes faster or by protecting users in other ways while a fix is in progress.

LLMs have also changed Project Zero's own workload. It says it now finds several vulnerabilities a week in targets where it once found a few a year, which, it says, is quickly making the parts of the policy that need vendor negotiation, such as agreeing whether a bug is fixed, unmanageable. The new policy is meant to be automated: Project Zero will still track whether bugs are fixed and say so when they are not, but that judgment no longer moves the deadline, and the grace period and variant policy are gone. The remaining exceptions are bugs already exploited in the wild, which follow Google's own disclosure policy, bugs others have already made public, and vendors who ask for disclosure. Severity does not change the timing either, because, Project Zero argues, a bug's severity affects its impact on users but not how likely attackers are to find it. For hardware, it notes rare past exceptions such as Spectre and Meltdown and says it will keep granting them.

The deadline shrinks in steps because vendors Project Zero consulted worried that an immediate cut could expose unfixed bugs while they improve their processes, push them to favor newly reported bugs over more severe older ones, or lead some to give up on deadlines they cannot meet. The claims about LLM-driven discovery are Project Zero's own assessment, and the announcement offers no measurements beyond its change in report volume. Earlier Intel on Epoch AI's patch-gap experiment shows one concrete version of the problem: an open-weight model used published but unshipped Firefox fixes to build working attacks, though on recent versions each success also relied on a separate, unpublished bug the model found. Epoch measured the window before a fix's general release, while Project Zero's definition covers the time after release, and the announcement does not cite Epoch's work.