GNOME is reducing its security vulnerability disclosure deadline from 90 days to 30 days in response to the rise of AI-generated submissions.
The new deadline applies to security issues reported on or after August 1, 2026. Previously, GNOME kept security reports confidential for up to 90 days to allow maintainers time to prepare and release fixes before public disclosure.
However, GNOME security coordinator Michael Catanzaro notes that the longer window has been ineffective. Maintainers typically resolve vulnerabilities within one to three weeks or not at all before the 90-day deadline.
GNOME considered, but ultimately rejected, the approach used by some open-source projects that immediately disclose reports suspected to be AI-generated. Catanzaro explains that this would place undue pressure on maintainers and does not conform to GNOME’s development model.
Instead, GNOME will adopt a 30-day deadline as a compromise, allowing maintainers time to address vulnerabilities while curtailing unnecessary confidentiality. Reports will be disclosed sooner if a fix is completed, and a CVE will be requested when appropriate.
The updated procedure will apply to all vulnerability reports, regardless of AI-generated content. Catanzaro notes that reporters seldom disclose AI use, and manually identifying AI-assisted reports would complicate the process. He also observes that reports found without AI assistance are now rare.
Moreover, GNOME is revising its approach to reports involving projects that prohibit AI-generated submissions. Since most vulnerability reports now include AI-generated content, GNOME will stop forwarding these reports directly to those projects’ issue trackers.
Instead, such reports will be closed in the central GNOME Security tracker, and relevant maintainers will be notified of their existence. Projects wishing to receive these reports directly are encouraged to add a security vulnerability exception to their AI-content policies.
Somewhat surprisingly, Catanzaro, who has managed security tracking since November 2020 with Red Hat’s support, will stop tracking new security issues on November 1, 2026. Throughout November, he will handle only cases submitted before that date, expecting all disclosure deadlines to pass by December 1.
Currently, no one else fills this role for GNOME. The project is seeking an experienced community member to assume these responsibilities, which include monitoring reported issues, tracking their status, publishing them when deadlines are reached, and requesting CVEs as needed.
For additional details, see Catanzaro’s post on the GNOME Blogs.
