Project Zero drops 30-day soak period, cuts disclosure deadline toward 30 days by 2028

Google's Project Zero has scrapped the extra 30-day "soak" period in its vulnerability disclosure policy. Effective immediately, the team will publish details of a reported bug 90 days after notifying the vendor, and that window will shrink in stages until it reaches just 30 days in January 2028.

A staged tightening

According to Project Zero's policy announcement, the team has operated a "90 + 30" model since 2021: vendors received 90 days to fix a vulnerability plus an additional 30 days for the patch to roll out to users. Under the new "Full X" policy, disclosure happens exactly X days after the report, with no soak time and most special cases removed, including grace periods and the variant policy. "Full 90" applies from the announcement itself, "Full 60" arrives on February 2, 2027, and "Full 30" on January 3, 2028.

Only three exceptions remain: bugs actively exploited in the wild, which will be handled under Google's broader application security disclosure policy; vulnerabilities whose details are already public, which Project Zero may disclose at its discretion; and cases where the vendor itself requests publication.

AI is the driving force

Project Zero attributes the change to AI-assisted attack and research. Large language models let attackers find and exploit vulnerabilities faster, and they raise the odds that someone else, including a malicious party, independently discovers the same bug while it sits under embargo. Reverse engineering a patch has also become quick enough that treating the gap between a patch's release and its exploitation as effectively zero is now a realistic, if rough, way to model attacker behavior, which in Project Zero's view makes soak time pointless and can leave users at risk under the false assumption that bug details are still secret.

Volume is the other factor. Project Zero says it now files several vulnerabilities per week against targets where it once found a few per year, making per-bug negotiations over whether a bug is fixed, or whether a grace period applies, unmanageable. The new policy is built around three stated goals: faster remediation, shorter "patch gap" (the time between a fix shipping and users actually installing it), and a process both Project Zero and vendors can automate.

Why the gradual schedule

Project Zero says it consulted the vendors it reports to most often while drafting the policy. Those vendors raised several concerns: an abrupt switch could hand unfixed bugs to attackers mid-transition, harsh deadlines could distort internal prioritization so that deadline-bound reports jump ahead of more severe bugs, and vendors unequipped to meet an immediate 30-day target might simply stop trying rather than fail repeatedly. The staged approach is meant to be demanding but achievable, pushing vendors to build remediation processes and infrastructure that can eventually handle every report quickly.

Severity, hardware and fix status

Severity will not affect disclosure timing. Project Zero argues that severity measures a bug's impact, not the likelihood an attacker finds it, and notes it already limits its tracker to bugs with substantial security impact, while acknowledging vendors may reasonably treat low-quality reports differently.

Hardware gets a partial carve-out: rare exceptions, such as those once granted for Spectre and Meltdown, will still be possible, and Project Zero encourages all vendors to plan non-patch defenses since there is no guarantee defenders find a bug first.

On fix verification, Project Zero will keep tracking whether bugs are fixed and will speak up when they are not, but fix status is no longer a decision point in the policy. That removes a negotiation that often took multiple rounds of back-and-forth per bug, and lets the team describe how users are protected without issuing a binary verdict that carries consequences for the vendor.

Why it matters

This is one of the clearest signals yet of how AI is compressing security timelines. Long embargoes once served vendors and users alike; Project Zero now argues the embargo itself is the risk, because attackers are increasingly likely to reach the bug first. Vendors, especially those with slow release cycles such as hardware and firmware makers, now face a hardening deadline structure with no negotiated extensions, and the emphasis on patch gap shifts responsibility toward getting fixes onto user devices quickly rather than merely shipping them. For the wider security community, it previews a norm shift: expect shorter disclosure windows across the industry as AI-driven discovery makes slow remediation increasingly indefensible.