Frontier models have lowered the bar for discovering and exploiting vulnerabilities. This has resulted in an increase of CVEs and workload for both SWE and vulnerability management teams. And yet the norms around coordinated vulnerability disclosure timelines have remained around 90 days. This timeline worked 10 years ago, but is unlikely to survive much longer. We need to move closer to a window of 30 days. But in order to do this we need to rely on those same models to accurately fix those vulnerabilities and coordinate the release and deployment of new versions. The primary blocker here seems to be confidence in those models to do that job well, and reluctance to remove humans from that loop. Every day the probability of another shellshock, log4j, or heartbleed rises. If you were in the trenches for those events then you know how difficult it was to track vulnerable assets, test and deploy patches, and ensure the risk was mitigated. We shouldn’t wait for a crisis like this to rethink and change these norms. We need to move much faster and that requires shorter disclosure timelines, and removing humans from the vulnerability management loop.