News
Policy and Disclosure: 2026 Edition
First reported projectzero.google
Page published
Earliest dated coverage: 13 Nov 2026 · First observed: 13 Nov 2026 · Latest dated coverage: 13 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Project Zero’s announced disclosure changes increase pressure on vendors and defenders to accelerate remediation and patch deployment as LLMs shorten exploitation timelines.
Project Zero announces shorter vulnerability disclosure deadlines, citing LLM-assisted vulnerability discovery, exploitation, and patch reverse engineering. The announced policy replaces its “90 + 30” approach with fixed 90-day disclosure, followed by 60-day deadlines in February 2027 and 30-day deadlines in January 2028, while removing most exceptions.