Google Project Zero's founding and the professionalization of vulnerability research (2014)
Google launched Project Zero, a dedicated team of elite security researchers tasked with finding zero-day vulnerabilities in any software, not just Google's. The team, led by Chris Evans, included researchers like Tavis Ormandy and Ben Hawkes who discovered critical flaws in Windows, iOS, and Flash. Their policy of disclosing vulnerabilities after 90 days — whether or not vendors had patched them — forced the industry to take response times seriously.
Major vendors including Microsoft and Apple accelerated their patching cycles. Vendors who missed the 90-day deadline faced public disclosure, creating strong incentives to fix vulnerabilities faster.
Project Zero established the model of a well-funded, independent team finding vulnerabilities at scale — the exact model that AI agents are now automating. The 90-day disclosure norm became an industry standard.
AI security agents are essentially automating Project Zero's workflow: reading code, understanding behavior, discovering flaws, and proposing fixes. The transition from a team of roughly a dozen elite researchers to autonomous agents that can scan millions of commits represents a step change in scale, not a change in approach.