Controls › C-O1
Coordinated disclosure program
A path for outside researchers to report and for the vendor to fix before exploitation.
External layerMissing or failed in 0 casesWorked in 6
Where it worked
| Case | World | What it looked like | Outcome |
|---|---|---|---|
| Kia dealer portal 2024 | Machines | Coordinated disclosure and pre-publication fix | Caught first by researchers |
| EchoLeak 2025 | Software agents | Coordinated disclosure | Caught first by researchers |
| Gemini calendar invite 2025 | Software acting on machines | Coordinated disclosure | Caught first by researchers |
| Claude Code [bot] trust 2026 | Software agents | Coordinated disclosure; Four-day patch | Caught first by researchers |
| Perplexity Comet 2025 | Software agents | Disclosure, albeit by a competitor | Caught first by researchers |
| Pydantic AI: a web page can make a… | Software agents | Coordinated disclosure and fix | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022) (draft mapping) | Recommended | a vulnerability reporting and disclosure policy for outside researchers | United States (voluntary) |
| NIST AI 600-1: Generative AI Profile of the AI Risk Management Framework (draft mapping) | Recommended | incident disclosure and engagement with outside reporters of issues | United States (voluntary) |
| Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, PP-26-4396, version 1.0) (draft mapping) | Recommended | Practices 8 to 10 (Coordinate with Affected Parties; Notify Government; Share Information Publicly): notify parties whose systems were compromised, voluntarily report to CISA, share details with the public | United States (voluntary) |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.