Why the 90-day responsible disclosure policy is obsolete in the age of LLMs

Summary

The article argues that the traditional 90-day responsible disclosure window for security vulnerabilities is obsolete in the age of LLMs. The author explains that AI tools have dramatically accelerated both bug discovery and exploit development, compressing timelines to near-zero. Drawing from firsthand experience and real-world examples, the author calls on the industry to treat every critical security issue as P0 (highest priority) and patch immediately, abandoning the old disclosure model that assumed slow exploit development.