AI is finding security bugs faster than maintainers can fix them. Should the 90-day disclosure deadline change? | Reasoned

AI tools are generating security vulnerability reports faster than open-source maintainers and volunteer projects can fix them, raising questions about whether the industry's standard 90-day disclosure deadline should change. Proposed adjustments include giving projects more flexible deadlines, requiring AI bug-finding companies to supply patches or funding, or shortening disclosure windows because attackers also use AI. Open article →