Responsible Disclosure in the Age of Vulnpocalypse
Red Hat, Monday, October 26th, 2026
Red Hat argues AI-driven vulnerability discovery demands stronger coordinated disclosure, risk-based embargoes, and support for maintainers.
Red Hat's Emily Fox says AI-assisted research is surfacing software flaws faster than teams can assess and fix them, a situation she calls the Vulnpocalypse.
Finding a bug is only the first step, since experts must validate it, measure impact, build fixes, and help operators protect systems.
Coordinated disclosure depends on trust, and embargoes give defenders a head start that early leaks or public commits destroy, while low-value reports burden maintainers.
She calls for better triage, clearer contacts, shared engineering capacity, and risk-based disclosure plans, concluding that security leadership is not a race to publish first.