OpenAI sets new rules for disclosing AI-found zero-days

For years, engineers worried that AI-generated code would introduce sloppy bugs. Now the tables have turned: AI has become an unrelenting code auditor, and it is finding critical flaws faster than humans can patch them.

OpenAI published its Outbound Coordinated Disclosure Policy. The guidelines explain how the company plans to handle security vulnerabilities that its systems uncover in third-party commercial software and open-source projects.

OpenAI acknowledged that its models have already discovered zero-day vulnerabilities in the wild. As reasoning capabilities advance, automated security analysis will only catch more bugs at scale.

Dropping the 90-day clock

The most striking part of the policy is OpenAI's stance on remediation deadlines. Traditional security research often follows a rigid schedule, such as a 90-day window before details are published regardless of patch status.

OpenAI is intentionally breaking away from that playbook by defaulting to open-ended timelines.

The reasoning is straightforward. As models analyze complex logic and surface harder bugs, patching them requires deeper collaboration and significant time. Imposing arbitrary countdowns on exhausted open-source maintainers could easily backfire.

Instead, OpenAI wants to work collaboratively with software maintainers to achieve long-term code resilience. That said, the company still reserves the right to disclose vulnerabilities publicly if public safety or interest demands it.

Low friction for a high-scale world

The policy covers vulnerabilities found through internal use, targeted open-source audits, and automated analysis via AI tools.

OpenAI outlined several guiding principles for disclosure: prioritize real-world impact, remain cooperative, stay discreet by default, and provide proper attribution.

Most importantly, the process is designed for high scale and low friction. With AI tools generating findings around the clock, OpenAI aims to report bugs in a structured manner without overwhelming downstream engineering teams.

Why it matters

We think this policy shows OpenAI smartly reading the room while addressing a looming structural shift.

For open-source developers, removing strict deadlines is a massive relief. Independent maintainers rarely have the bandwidth to drop everything for an arbitrary 90-day ticking clock. OpenAI’s flexible approach treats maintainers as partners rather than adversaries.

For the broader security ecosystem, it signals the collapse of old assumptions. Responsible disclosure norms were built around the pace of human researchers. When AI models can review millions of lines of code and spot zero-days at near-zero marginal cost, the volume of incoming reports will skyrocket.

The only real risk here is accountability. Open-ended deadlines can easily turn into indefinite delays for sluggish enterprise vendors. Still, OpenAI is taking the first step to set rules for the coming avalanche of AI-driven bug reports, and other frontier labs will likely have to follow suit.