Newshot
Account

Rising to the AI Vulnerability Discovery Challenge: Google Project Zero Plans to Gradually Shorten Public Disclosure Window to 30 Days

Source: IT之家 Published: AI 中文 AIProjectZero
AI summary

Since 2021, Google's Project Zero has followed a "90 + 30" vulnerability disclosure policy, allowing vendors up to 90 days to fix a vulnerability plus an additional 30-day buffer period for patch rollout. On November 13 local time, Google announced that with the rise of AI-assisted vulnerability discovery and exploitation, the situation has fundamentally changed and the remediation timelines set by the existing policy no longer meet current needs. Google's new policy states that a vulnerability will be publicly disclosed X days after being reported to the vendor regardless of whether it has been fixed, with the time limit tightening in stages: from November 13, 2026, the original 30-day patch buffer is eliminated and disclosure occurs 90 days after report; from February 2, 2027, disclosure occurs 60 days after report; and from January 3, 2028, disclosure occurs 30 days after report.

Translation(model translation, not the source's own text)

Addressing AI Vulnerability Discovery Challenges: Google Project Zero Plans to Gradually Shorten Public Vulnerability Disclosure Period to 30 Days

IT之家 news on November 15: Since 2021, Google's vulnerability discovery program Project Zero has followed a “90 + 30” vulnerability disclosure policy, allowing vendors up to 90 days to fix vulnerabilities and providing an additional 30-day “buffer period” for patch rollout.

On November 13 local time, Google announced that with the rise of AI-assisted vulnerability discovery and exploitation technologies, the current situation has undergone fundamental changes, and the remediation timelines set by the existing disclosure policy can no longer meet demand.

IT之家 has learned that, to push vendors to fix vulnerabilities more quickly and encourage them to shorten the “patch gap,” Google has released a new vulnerability disclosure policy. The new policy stipulates that, regardless of whether the vendor has completed remediation, vulnerabilities will be directly publicly disclosed X days after being reported to the vendor, with time limits tightened gradually in phases.

  • From November 13, 2026, cancel the original 30-day patch buffer period and disclose 90 days after report
  • From February 2, 2027, disclose 60 days after report
  • From January 3, 2028, disclose 30 days after report

At the same time, Google will remove the vast majority of “special cases” from the disclosure policy. The new policy retains only the following three exceptions; when these conditions are triggered, disclosure will not wait the full X days:

  • Vulnerabilities exploited in the wild (ITW): vulnerabilities already actually exploited by attackers continue to follow Google's Application Security Vulnerability Disclosure Policy
  • Publicly disclosed vulnerabilities: if vulnerability details have already been publicly disclosed by others in advance, Project Zero may disclose detailed information about the vulnerability at its discretion.
  • Upon vendor request: if the vendor receiving the vulnerability report proactively makes a request, Google will disclose vulnerability details.

Related articles

  • Google Pixel series phones have issues after the November update: screensaver cannot enter low-brightness mode
  • Google rolls out Android Auto 18.2 beta, code shows the official team is continuing to develop a light mode menu interface
  • Google Gemini personal intelligence feature integrated into the Google Wallet app: can provide personalized analysis suggestions for users' spending habits
  • Google uses multiple specialized AI agents to build the Teamwork system, successfully verifying multiple complex mathematical proofs
  • Google open-sources the dataset used by the WeatherNext 3 weather model: includes the SatWeave satellite imagery stitching dataset and PARDIG global precipitation information
  • AI taking over phones takes a key step: Google Gemini automation app list exposed, currently 134 apps in total

The translation is machine-generated and individual terms may be off. Nothing is rewritten or cut; the original is authoritative.

Published by IT之家
This site only summarises and aggregates; copyright stays with the original author. Headlines and summaries follow the source — where they differ, the original wins.
Read the original ↗