For years, coordinated vulnerability disclosure followed a familiar rhythm: a researcher finds a bug, privately tells the vendor, and the public hears about it after a fix ships or a deadline passes, commonly 90 days. AI is straining that rhythm from two directions. It helps defenders find far more bugs, and it helps attackers turn a published fix into a working exploit far faster.

This article explains what is driving the compression, what vendors are changing, and what trade-offs remain.

Why the Window Between Disclosure and Exploitation Is Collapsing

A CVE (Common Vulnerabilities and Exposures) is a public identifier for a known security flaw. An n-day is a flaw that is already publicly known, as opposed to a zero-day, which the vendor does not yet know about. The key shift is that attackers do not need to discover new bugs to benefit from AI. They can weaponize known ones quickly.

Google Threat Intelligence Group (GTIG), in an analysis of vulnerabilities disclosed from January 1, 2025 through August 31, 2026, says AI is measurably changing the pace and types of vulnerability discovery and exploitation. SecurityWeek reported that GTIG sees threat actors possibly using LLMs to automate comparison of product versions, patches, advisories, and proof-of-concept code. That turns a patch into a roadmap to the flaw it fixes.

The figures reported by different analysts point the same way, though they measure different things:

  • Cogent, analyzing 69,159 CVEs, says the average time from disclosure to a working exploit fell from 125.3 days in January 2025 to 0.5 days in April 2026, and attributes this to AI-assisted exploit development.
  • McKinsey reports that industry tracking puts the gap between disclosure and active exploitation at hours for the most critical exposures, down from roughly three weeks in 2025. It stresses this concerns high-severity, actively exploited flaws.
  • A Cloud Security Alliance whitepaper citing Rapid7's 2026 Global Threat Landscape Report says the median time from disclosure to inclusion in CISA's Known Exploited Vulnerabilities catalog fell from 8.5 to 5.0 days, and that exploited high- and critical-severity CVEs rose 105% year over year (146 in 2025 versus 71 in 2024).

A concrete case: Axios reported in July 2026 that a Dream researcher observed an attacker take nine hours to build a working exploit for a critical flaw after disclosure, then target government customers.

How Disclosure Policies Are Adapting

If defenders can no longer assume weeks of quiet after a fix is published, long fixed deadlines look less sensible. Policies are changing in two ways: tiering deadlines by risk, and changing how fixes are released.

Tiered timelines

Anthropic says it aims to notify vendors and maintainers quickly and to publish details after 90 days or once a patch is released, whichever comes first. If a maintainer does not respond within 30 days, it aims to escalate to an external vulnerability coordinator and proceed to public disclosure when the applicable timeline expires. Reports that come from AI-powered discovery are labeled as such.

According to a Cloud Security Alliance whitepaper, the policy Anthropic published in March 2026 ties timelines to severity and exploitation status. For actively exploited critical vulnerabilities it describes a seven-day timeline, with a further seven days if the maintainer is actively working on a fix, and a 45-day wait after a patch before full exploitation details are published. The standard timeline remains 90 days.

Scheduled releases

Vendors are also restructuring patch delivery. Cisco said it moved to scheduled, twice-monthly security disclosures starting in July, with seven days' advance notice of which technologies each release will cover. Its reasoning: frontier AI models and agentic analysis are surfacing bugs across large codebases at a rate the old ad-hoc disclose-and-patch model was not built to absorb. It said it is prioritizing AI-discovered findings and systemic hardening.

Volume as a driver

Shorter timelines are not only about attackers. AI-assisted defenders also find more bugs. A Cloud Security Alliance research note says Anthropic's Project Glasswing, a coalition of twelve technology organizations using Claude Mythos Preview for autonomous vulnerability research, discovered more than ten vulnerabilities. More findings per maintainer means more pressure to fix, coordinate, and disclose on a predictable cadence.

What It Means in Practice, and What Remains Unsettled

For organizations running software, the practical message is that a patch-centric model, where you queue updates and apply them in the next cycle, is being undermined. The CSA whitepaper argues that AI-accelerated exploit development, pre-disclosure exploitation, and rising vulnerability volume all erode it. McKinsey notes that responding well involves security, IT, business, legal, procurement, and operations teams, not just a patching group. Sensible preparation includes knowing which assets are internet-exposed, having a fast path for emergency updates, and having mitigations such as configuration changes or network controls ready before a patch exists.

The trade-offs are real. The same CSA material notes that faster disclosure can create a security tradeoff: a shorter private window gives maintainers, especially small open-source teams, less time to build and test a fix, while publication can hand attackers information before users can update. Compressed deadlines also assume maintainers can respond quickly, which is not always true.

The data itself needs careful reading. The headline figures come from different datasets and definitions, and McKinsey explicitly limits its estimates to high-severity, actively exploited flaws. A 0.5-day average does not mean every CVE is exploited within hours.

Conclusion

Disclosure timelines are shortening because AI compresses the work between a public fix and a working exploit, while also increasing the number of bugs found. Vendors respond with severity-tiered deadlines and scheduled patch releases.

No policy removes the underlying tension between giving maintainers time and limiting attackers' head start. For most organizations, the lasting change is operational: assume the window after disclosure is hours to days, and plan accordingly.