{"slug": "project-zero-ends-the-grace-period-ai-is-why", "title": "Project Zero Ends the Grace Period — AI Is Why", "summary": "Google Project Zero ended its \"90 + 30\" vulnerability disclosure policy on November 13, replacing it with a \"Full 90\" policy under which technical details go public exactly 90 days after a bug is reported to a vendor, regardless of whether a patch exists. The change removes the 30-day buffer that since 2021 gave vendors extra time before details were published after shipping a fix, and Project Zero attributes the shift to AI. The post frames the old soak period as designed for a world where patching and attacker exploitation moved at a slower pace.", "body_md": "Google Project Zero killed the grace period on November 13. Under the old “90 + 30” policy that has governed vulnerability disclosure since 2021, vendors who shipped a patch got an additional 30-day buffer before technical details went public — time for users to install the fix before attackers could read the diff. That buffer is gone. Under the new “Full 90” policy, disclosure happens exactly 90 days after Project Zero reports a bug to a vendor, whether or not a fix exists. Patch status no longer moves the deadline. The 30-day soak period was designed for a world where […]\n\nThe post", "url": "https://wpnews.pro/news/project-zero-ends-the-grace-period-ai-is-why", "canonical_source": "https://byteiota.com/project-zero-ends-the-grace-period-ai-is-why/", "published_at": "2026-11-15 10:10:14+00:00", "updated_at": "2026-11-15 10:22:28.816623+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["Google Project Zero"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/project-zero-ends-the-grace-period-ai-is-why", "markdown": "https://wpnews.pro/news/project-zero-ends-the-grace-period-ai-is-why.md", "text": "https://wpnews.pro/news/project-zero-ends-the-grace-period-ai-is-why.txt", "jsonld": "https://wpnews.pro/news/project-zero-ends-the-grace-period-ai-is-why.jsonld"}}