The Window Was a Guess About Speed
Ninety days is the clock almost every coordinated-disclosure program runs on. A researcher finds a bug, tells the vendor, and the vendor gets roughly three months before the details go public whether or not a patch exists. Nobody picked ninety because it's a tidy number. Someone looked at how long it typically took a capable attacker to turn a vulnerability report into a working exploit, and wrote that duration down as a policy.
Google's Project Zero launched in 2014 with the ninety-day deadline already attached, and the number has barely moved since. In 2021 they added a 30-day grace period for vendors who ship a patch but need more time for users to actually install it, which is itself a tell: the original ninety days was never about disclosure ethics in the abstract, it was a labor estimate for two different kinds of work happening on two different clocks, the attacker's exploit-dev timeline and the defender's patch-and-deploy timeline. The policy bet that the first number would stay bigger than zero long enough for the second one to finish.
That bet made sense when exploit development was artisanal. Turning a bug report into a reliable proof of concept meant understanding the specific memory-corruption primitive, fighting the mitigations stacked on top of it, often hand-building a chain that worked on one target configuration and nowhere else. That's days of skilled labor at minimum, sometimes weeks. The ninety-day window was quietly metering that labor and handing defenders the difference as a head start.
Automated exploit generation was a research curiosity for a long time, DARPA ran a fully automated capture-the-flag tournament a decade ago and the systems that competed were slow and narrow. What's changed is that a model can read a diff, a CVE writeup, or a decompiled patch and get to a working proof of concept in a sitting rather than a sprint. Not for every bug, and not yet for the hard end of the distribution, where the chain still wants a person. But the easy end keeps widening, and the direction of travel has been the same for a while now. The skill that used to gate exploit development, understanding the primitive well enough to build the chain, is increasingly a prompt away from being done for you. The bottleneck the ninety-day number was built to measure is being removed from the process it was measuring.
This is the part that gets missed when people argue about whether ninety days is "enough" or "too generous." The number was never a property of security, it was a snapshot of attacker labor cost at a particular moment, frozen into a rule and then treated as if it had always been a constant. Once the labor cost collapses, the rule doesn't become wrong exactly, it becomes a fossil. It keeps getting followed because it's the rule, while the thing it was quietly protecting, a defender's lead time over the first working exploit, has already gone to zero or negative. A vendor patching on day ninety used to be patching with a comfortable margin before weaponization. Now they might be patching after the exploit has been circulating for eighty-eight days, and the policy document says nothing changed because the number on the page didn't.
What makes this worse than an ordinary stale policy is that security disclosure has an adversary who doesn't have to respect the assumption at all. A compliance deadline calcifying into a constant mostly just wastes everyone's time. A disclosure deadline calcifying into a constant hands the mismatch straight to whoever's on the clock without telling them the clock has been reset. The defenders scheduling their patch rollout around day ninety are operating on an estimate that was accurate for a world where exploit development required a person who knew what they were doing and had the time to do it. They're not wrong to trust the number. They're wrong to assume the number is still measuring anything.
A fixed window that no longer tracks the speed it was built to track isn't a neutral middle ground between researcher and vendor interests. It's a certificate, stamped and dated, that says the old assumption still holds. Policy that stops checking its own premise doesn't fail loudly. It just keeps running on a number that used to mean something.