Deciding Whether to Publish Sensitive Security Research

Publishing sensitive security research is a risk decision. The defensible path weighs four things together, namely disclosure school fit, exploitation timing, vendor responsiveness, and public harm potential. That calculus cannot make publication harmless, but it can replace a gut feeling with a documented reason to publish, wait, or release less.

Why the publication decision keeps failing researchers and users alike

A researcher reports a flaw, gets turned away, and goes public. Then the dispute becomes a second incident to manage. The AMD / MrBruh case from early 2026 followed that unhappy sequence, with a report closed as out-of-scope, a bounty denied, and public disclosure becoming the researcher’s route forward. AMD then retroactively changed its program terms. By that point, the argument was about both the vulnerability and the rules for reporting it.

CVE-2026-40677 received a patch 124 days after the first report, but MrBruh found what appeared to be only a forgeable CRC-32 checksum. AMD claimed signature verification was also added. That distinction belongs in the account because a disputed fix is not the same as an agreed resolution. News of a patch alone does not show how much risk is left.

Without a reporting channel that works, terms that stay the same, and an agreed process for publication, even good-faith researchers can end up choosing between staying silent and starting a dispute. Users inherit the uncertainty while the parties argue over procedure. A decision framework gives researchers a way to assess that uncertainty before a disclosure dispute becomes the only functioning communication channel.

The three disclosure schools and what each one actually costs

Non-disclosure keeps the finding private and preserves an intelligence advantage. Its cost is concentrated in what happens if the secret escapes while users remain exposed. The NSA’s years-long withholding of EternalBlue ended with WannaCry and NotPetya in 2017, causing billions in damage. Secrecy left the underlying vulnerability in place and kept the knowledge unevenly distributed until that arrangement failed.

Coordinated disclosure gives the vendor time to address the flaw before public release. In exchange, researchers and affected users depend on the reporting channel, the vendor’s response, and the agreed window. Some bounty programs have legal terms that ban all public disclosure with no end date. Under those terms, coordination can become vendor-controlled silence with no community alert. “Responsible” is doing rather a lot of work there.

Public disclosure breaks that information bottleneck, allowing defenders to learn about an exposed product without waiting for vendor permission. But attackers can learn about the exposed product too. Publishing a working proof-of-concept changes the cost structure again because it gives readers more than a warning. The three schools thus put different people at risk, which makes them hard to rank from ethical to reckless. Choosing one on principle alone leaves out the conditions that determine who benefits and who gets hurt.

Why the exploitation clock makes the timing question non-negotiable

CrowdStrike’s 2026 Threat Hunting Report says nation-state adversaries exploit vulnerabilities within hours of an effective proof-of-concept disclosure. For a researcher releasing a working PoC, that puts nation-state exploitation attempts inside the same day. Publication is not merely a date on the calendar. The level of detail released can determine how quickly the finding becomes useful to an attacker.

Rapid7’s 2026 Threat Landscape Report places the median time from vulnerability publication to inclusion in the CISA Known Exploited Vulnerabilities catalog in days. Catalog inclusion and an attacker’s first attempt are different events, so the figures should not be treated as interchangeable. Together, however, they show how compressed the decision window has become. A published flaw can move quickly from research output into active threat intelligence.

Waiting may give a vendor time to fix the problem, while releasing technical detail may speed up exploitation before users can act. Conversely, withholding all information can leave defenders without a useful warning. Timing must therefore be assessed with the content of the release. The calendar is part of harm reduction, and granting time has a defensible purpose when the vendor is responsive.

Reading vendor responsiveness before the clock runs out

For the researcher, due diligence starts with observable commitments. A publicly documented vulnerability disclosure policy, or VDP, establishes scope and an accessible route for reporting. Concrete acknowledgment timelines, safe harbor language protecting researchers from legal action, and a record of assigning CVEs and crediting reporters add useful evidence. A friendly inbox is not a process. The vendor’s commitments should make it clearer what will happen next.

Negative signals weaken the case for extending the window. They include closing a report as out-of-scope on arrival, denying a bounty without technical justification, or editing terms retroactively after a dispute. The AMD case illustrates why stable rules belong in the assessment. Microsoft’s revocation of Nightmare Eclipse’s platform access in response to criticism supplies another warning signal. These actions inform the publication decision, but they do not replace a separate assessment of harm to users.

A missing program leaves a structural blank. The CRA Working Group’s July 2024 conference policy report recommends documenting disclosure steps taken or planned, and explaining why disclosure is not pursued when it is not. That discipline also applies before publication. The EU’s Cyber Resilience Act begins imposing mandatory reporting obligations on September 11, 2026, and requires manufacturers of products with digital elements to maintain an accessible disclosure channel. A June 2026 U.S. executive order told the FAR Council to propose VDP requirements for the federal contractors it covers, building on CISA’s 2020 binding directive for federal civilian executive branch agencies. That order initiates rulemaking, rather than establishing a completed contractor requirement.

Mapping public harm potential before choosing a publication path

The parallel assessment concerns who could be hurt and how readily. A responsive vendor does not make a flaw in a medical or safety system low-risk. Critical infrastructure and widely deployed consumer software also raise the potential for public harm. The assessment must distinguish the quality of the reporting relationship from the consequences of exploitation.

A flaw requiring minimal attacker capability presents a different problem from one requiring physical access or a privileged position. Long patch cycles, embedded systems, and legacy code can leave users at risk even after a fix is available. By contrast, a small population that can be directly notified lowers the difficulty of reaching those at risk. A mitigating control that defenders can apply before a patch ships also changes the publication options.

Dual-use potential needs its own place in this assessment. The Council of Canadian Academies’ 2025 expert panel report identifies the central tension in sensitive research, where a beneficial finding may also help malicious actors harm the public, public health, public safety, and economic and national security. Good intent does not travel with the download. A novel exploit can inspire misuse even when its disclosure was coordinated. Procedural compliance cannot stand in for an assessment of what the released material enables.

How the variables combine into a publication decision

The framework scores four variables, namely disclosure school fit, exploitation timing, vendor responsiveness, and public harm potential. School fit shows which trade-off is being weighed, while timing tests how quickly publication could change the threat. Vendor signals show whether there is good reason to keep coordinating, and harm mapping shows how affected users are likely to be hurt. None supplies a decision on its own. Together, these variables guide the choice to wait, publish, or release a limited warning.

When harm potential is high and exploitation speed is fast, the coordinated window should be at the short end regardless of vendor preference. That does not mean rushing a working exploit into public view. Project Zero’s tiered approach, or publication of impact and affected-product scope without technical details, provides an intermediate path when harm potential is high but exploitation is not yet confirmed. It can alert defenders without supplying the exploit itself. If vendor signals turn negative before the window closes, as in the earlier reporting disputes, the case for publication strengthens.

When harm potential is lower and the vendor shows positive signals, an extension is defensible. The researcher should document it and set a hard outer deadline, preventing coordination from drifting into non-disclosure. Anthropic’s threat intelligence model shows how a vendor handles a similar choice. Its case studies of disrupted malicious misuse in March, August, and November 2025 and February and September 2026 frame publication as a public duty, with intelligence shared with authorities and safeguards strengthened.

A study in the Proceedings of the 35th USENIX Security Symposium in August 2026 found that most AI vendors had no established bug-bounty or responsible disclosure policy, with jailbreaking and hallucination most commonly declared out-of-scope. The working group’s report also says that conferences differ in the ethics-review requirements they set. The framework can point out where that pathway is missing, but it cannot treat a shared process as already in place.

Where the strongest objection to publication lands — and how to answer it

The strongest objection is that publication creates a weaponization window, and researchers bear moral responsibility for what happens inside it. Three bugs published by Nightmare Eclipse, CVE-2026-33825, CVE-2026-41091, and CVE-2026-45498, were exploited in the wild after publication. That gives the objection empirical weight. Writing down the process cannot undo that harm.

Harshini Sri Ramulu et al. at Paderborn University reviewed 1,154 papers published in 2024 at the four major security conferences, CCS, IEEE S&P, NDSS, and USENIX Security. They found that most technical security papers did not discuss ethical considerations. The finding exposes a weakness in the record available for scrutiny. Harm analysis is not yet reliably visible as a standard step. A publication framework must acknowledge that gap rather than assume the community already practices what it recommends.

Yet treating any weaponization risk as a veto leads toward indefinite non-disclosure, with the kind of accumulated exposure EternalBlue illustrates. Harm mapping, timing analysis, and limits on technical detail aim to minimize the window. Katie Moussouris’s chilling-effect warning identifies the opposite danger, where treating disclosure as criminal discourages reporting and leaves flaws undiscovered. A good-faith, documented rationale can help reduce legal exposure, but it is not immunity from either legal consequences or moral responsibility.

How security vendors can use the same calculus to build disclosure credibility

For vendors, the same framework becomes a two-way obligation. Maintaining the channel, honoring the window, and publishing transparently provide the evidence researchers need when deciding whether to coordinate. A VDP with explicit safe harbor language, concrete timelines, and a public record of researcher credit makes that commitment visible. Trust needs something firmer than a landing page. Those signals also reach the practitioner community that vendors hope to serve as customers.

For vendors that produce original research, harm mapping and timing guide when and how to publish threat intelligence just as they guide vulnerability disclosure. The decision concerns when findings are released, how much technical detail they contain, and whether the intended audience can act on them. Rapid7’s “BPFdoor in Telecom Networks” research and its 2026 Péter Szőr Award for Outstanding Research illustrate how emergent threat response, proprietary intelligence, and adversary insights can earn industry recognition. The credibility comes from the research contribution. Consistent publication decisions make that contribution easier for practitioners to judge.

Original threat research grounded in first-hand data, vendor-agnostic implementation guidance, and transparent acknowledgment of product limits give technically sophisticated readers something useful to assess. Product-focused copy cannot substitute for those outputs. Practitioners navigating disclosure trade-offs have little reason to trust a vendor that erases the dilemma from its own messaging. Credibility grows when the vendor makes the same disciplined choices it asks researchers to make, including publishing less detail when protecting users requires it.