Project Zero drops soak time, moving to a 30-day disclosure clock

Google Project Zero is rewriting the disclosure policy much of the industry benchmarks against. Out: the 90+30 model in place since 2021 — 90 days to fix, plus a 30-day "soak" for rollout. In: "Full X" — public disclosure a fixed number of days after a bug is reported to the vendor, regardless of whether a patch exists. The stated driver is AI-assisted vulnerability discovery and exploitation. If you ship software, your effective fix window is shrinking on a published schedule.

What changed and when

Per the Project Zero announcement, the clock now starts at the report date and the soak period is gone. The reduction is phased:

1. Full 90 — effective with the November 13, 2026 announcement.
2. Full 60 — from February 2, 2027.
3. Full 30 — from January 3, 2028.

Severity no longer drives disclosure decisions. Whether a bug is fixed is still tracked and communicated, but it is no longer a decision point in the timeline. Most special cases — the grace period, the variant policy — are removed. The exceptions that remain: bugs under active exploitation (handled via Google's application-security disclosure policy), already-public bugs (at Project Zero's discretion), vendor requests to publish details, and rare hardware cases like Spectre/Meltdown.

Why Project Zero says it's doing this

The post's reasoning is explicit about AI. LLMs let attackers find and exploit bugs faster and raise the odds that several parties — including malicious ones — independently find the same flaw. Patch-based reverse engineering has accelerated to the point that Project Zero now treats zero patch-to-exploitation time as "a reasonable, though imperfect, model of attacker behavior" — which, it argues, makes soak time meaningless. The team also says it now reports several vulnerabilities a week, versus a few a year previously, and that negotiating fix status and grace periods at that volume is unmanageable. The goals: faster remediation, a smaller patch gap, and a policy both sides can automate.

What it means for you

1. Vendors: assume a hard, public deadline measured from report, not from patch. Build the pipeline to ship and roll out inside 90 days now, 60 next February, 30 in 2028.
2. Defenders: expect more public, possibly unpatched disclosures from Project Zero, and plan compensating controls for the gap between disclosure and a deployable fix.
3. Both: the "patch gap" — fix released vs. actually installed — is now the metric that matters most; measure and shrink yours.

Context

This is the disclosure-process half of a theme we keep seeing on the AI beat: the same LLM-assisted capability that speeds up defenders' bug-finding speeds up attackers' exploitation, and the institutions that set industry norms are adjusting their timelines to match. A coordinated-disclosure program the size of Project Zero's moving to a 30-day clock will pull other researchers' and vendors' expectations with it. The honest read: this is less about punishing slow vendors and more about Project Zero conceding that the old soak-time assumption no longer survives contact with how fast exploitation now follows a patch.