Policy and Disclosure: 2026 Edition
Summary
Project Zero updates its vulnerability disclosure policy to address AI-assisted vulnerability discovery and the faster exploitation landscape. The new Full X policy discloses vulnerabilities 90 days after reporting to the vendor under Full 90, with planned moves to Full 60 and Full 30 in the coming years, and maintains exceptions for actively exploited, publicly disclosed, or vendor-requested disclosures. The article outlines the rationale for faster remediation, reduced patch gap, and the move toward policy automation.