AI Has Broken The Vulnerability Disclosure Model

The traditional vulnerability disclosure model has worked for decades — find a bug, report it, get it patched. But AI has shattered that process, and the security community is scrambling to catch up.

Businesses integrating AI into daily workflows face a fundamental problem: the mechanism for flagging vulnerabilities to AI providers is broken. The conventional disclosure lifecycle — identification, reporting, verification, patching — assumes a static software artifact with a reproducible bug. AI models, by contrast, are dynamic, opaque, and often non-deterministic, making it nearly impossible to determine whether a given behavior is a flaw or a feature.

For decades, vulnerability disclosure has relied on coordinated processes managed by CERTs, bug bounty platforms like HackerOne and Bugcrowd, and the Common Vulnerabilities and Exposures (CVE) system. Security researchers would find a flaw, notify the vendor privately, allow time for a fix, and then publish details. That system assumed software that could be versioned, patched, and redeployed. AI breaks every one of those assumptions.

Key challenges are now well-documented. First, AI models are continuously updated and fine-tuned, so there is no stable version to patch. Second, the same input can produce different outputs due to randomness in inference, meaning a reported vulnerability may not be reproducible. Third, model opacity — the black-box problem — means even if a harmful behavior is detected, the root cause may be unknowable. Fourth, liability is unclear: is the flaw in the training data, the architecture, the prompt, or the application layer? Companies like OpenAI, Google, and Anthropic have bug bounty programs, but researchers report long delays, inconsistent severity ratings, and a lack of clear channels for reporting model-specific issues.

Named organisations affected include EVERY AI provider from tech giants to startups. For example, in 2025, a researcher found that a major AI assistant could be manipulated to reveal sensitive financial advice in violation of its own safety guidelines. The report was filed but sat for months without resolution. Such stories are becoming common. The Open Source Security Foundation (OpenSSF) and the OWASP AI Security community have started drafting revised disclosure guidelines, but adoption lags.

Analysis from informed observers suggests the vulnerability disclosure model itself is not salvageable in its current form. "We need a new paradigm that accounts for probabilistic behavior and continuous deployment," says Katie Moussouris, founder of Luta Security. "The CVE system was built for certainty. AI operates in uncertainty." The implications are broad: without a functioning disclosure pathway, enterprise customers cannot evaluate the security of AI products before adoption. Regulators in the EU and US are beginning to scrutinise this gap, with the AI Act and Executive Order 14110 both calling for transparency and accountability mechanisms, though neither prescribes how disclosure should work.

Looking ahead, several milestones are worth watching. The MITRE Corporation is expected to release an AI-specific vulnerability taxonomy (ATLAS) update later this year. Bug bounty platforms are experimenting with dynamic rewards that account for model drift. The Cybersecurity and Infrastructure Security Agency (CISA) recently held a closed-door workshop on AI incident reporting. The direction is clear: the old disclosure model is dead, and the new one hasn't been born yet. Companies that rely on AI must now treat security as a continuous process rather than a one-time patch cycle.