"Exploit time dropped from 30 days to 30 minutes" — the 30 minutes was one researcher, one patch, and a denial-of-service proof of concept

You have seen the line. Exploit development used to take thirty days; now it takes thirty minutes. It appears in vendor decks, conference abstracts and newsletter subject lines, usually with no source attached.

It has a source. It is one person, one afternoon, and one experiment — and the person who did it is more careful about it than most of the people quoting him.

What was actually done

Security researcher Himanshu Anand published "The 90 day disclosure policy is dead" in May 2026.

He took React's published security patches — CVE-2026-23870, CVE-2026-44575 and others — and worked from the patch back to an exploit with a language model doing, in his words, most of the heavy lifting on understanding and exploitation.

30 minutes. From reading the patch to having a working exploit

The caveats are his own, and they matter:

• The result was a denial-of-service proof of concept, not remote code execution
• It was a local experiment on test applications
• He notes his own recommendation — treat every critical issue as P0 immediately — sounds extreme, and acknowledges production complexity

So the honest version of the headline is: an experienced researcher, using an LLM, turned a published patch into a working DoS PoC against a test app in half an hour.

That is genuinely notable. It is not the same sentence as "attackers weaponise patches in thirty minutes", which is what it has become.

The stronger evidence is the part nobody quotes

Anand's post has three arguments and the weakest one went viral.

Duplicate convergence. He reported a critical e-commerce vulnerability in April and found he was reporter number eleven for the same bug, discovered over roughly six weeks.

Eleven Freaking people found the same critical bug in roughly six weeks.

This is the more consequential claim, because it attacks the other assumption underneath 90-day disclosure: that the finder is rare. If eleven independent people find the same bug in six weeks, the vendor's embargo is not protecting a secret. It is protecting a rumour.

Copy Fail (CVE-2026-31431). Discovered by the Xint Code/Theori team — described as a "732-byte Python script that gives you root on every single Linux distribution". AI-assisted discovery took about an hour. Exploitation by Iranian threat actors was observed within days.

Dirty Frag (CVE-2026-43284, CVE-2026-43500). Reported by Hyunwoo Kim on 29–30 April. The embargo was broken within hours by an unrelated third party, at a moment when, as Anand puts it, "zero Linux distributions had a patch available." Microsoft Defender confirmed active exploitation within 24 hours of disclosure.

Those three are about real vulnerabilities, real attackers and real timelines. They carry the argument. The React number is the one on the slides.

The statistics stacked around it

Once the claim travelled, other numbers attached themselves to it. The ones in circulation:

Read down that column and it looks like a trend line. It is not one. These are separate measurements, by separate organisations, of different populations — some measuring all CVEs, some only exploited ones, some only KEV entries, some counting from disclosure and some from patch availability.

Chaining them produces a curve that no single dataset supports. "Gone negative" in particular means exploitation before disclosure, which is a different phenomenon from fast exploit development and cannot be plotted on the same axis.

We made the same point about an August Patch Tuesday that three outlets counted three different ways. A number without a stated method is a vibe.

What is nonetheless true

Do not over-correct. The direction is not in dispute, and there is independent evidence for it in this very story:

• The Copy Fail timeline — AI-assisted discovery in about an hour, state-linked exploitation within days — is not from a marketing blog
• The Dirty Frag embargo collapse, with confirmed exploitation inside 24 hours and no distribution patched, is a documented failure of the coordinated model
• The vCenter flaw exploited five days after public disclosure is an independent data point from a different vendor entirely

Anand's core argument stands on those: the 90-day model assumed rare finders and slow exploit development, and both assumptions are weaker than they were.

What to do with this

• Stop quoting "30 minutes" as an industry statistic. It is one experiment producing a DoS PoC on a test application. Cite it as that, or cite Copy Fail instead.
• Do not build a trend line from vendor numbers with different methods. If you must present one, present each figure with its source and its definition, and let the gaps show.
• Take the duplicate-convergence point seriously. It is the strongest and least-quoted finding here, and it argues for shorter embargoes on the same evidence that argues for faster patching.
• Measure your own window. Time from vendor patch to your deployment is a number you actually own, and it is the only one in this discussion you can act on.

The irony of a claim about AI-accelerated exploitation is that it spread the way it did for entirely pre-AI reasons: a good round number, an alarming comparison, and nobody clicking through to the caveats the author put in his own post.