Microsoft's AI bug-hunting lab counted 140 Windows CVEs in five months — and says finding bugs is no longer the hard part

Microsoft's FORGE lab, its in-house team for AI-driven vulnerability research, says it helped find Windows vulnerabilities assigned 140 CVEs between May and September 2026 and filed 155 validated reports across 23 open-source projects, with Linux kernel crash proofs costing an average of $3.61 in model spend. The post's real argument is that discovery has stopped being the bottleneck: validation, maintainer capacity and patch deployment now decide how much security the bugs actually buy. For the people who install Microsoft's patches, the same shift shows up as monthly releases that have grown from 198 CVEs in June to 964 in September, by Tenable's count.

The short version

On October 7, 2026, Taesoo Kim, Microsoft's vice president for agentic security, published "3 lessons from frontier AI vulnerability research" on the Microsoft Security Blog. It is the first scorecard from the Frontier Offensive Research & Generative Exploitation (FORGE) Lab, which runs Microsoft's multi-model agentic scanning harness, MDASH, against Windows, the Linux kernel and open-source projects.

The headline numbers are large, but the post is mostly about what goes wrong when AI makes bug-finding cheap. More AI "auditors" produce more candidate bugs, not more fixes. Duplicates and weakly evidenced reports eat the attention of the humans who must triage and patch. And open-source maintainers do not agree on what counts as a security bug, how it should be reported, or whether a patch must come with it.

That matters well beyond Microsoft's research team. In July, Windows told customers to expect "a higher volume of security updates included in each security release" because of AI-powered discovery. Since then Patch Tuesday has set two records. If you run patching for an organisation, this post explains where those numbers come from — and why they will not shrink.

Timeline

• May 12, 2026 — Microsoft introduces MDASH, claiming an 88.45% score on the public CyberGym benchmark.
• June 9, 2026 (Patch Tuesday) — 198 CVEs, then a record, according to Tenable.
• July 9, 2026 — The Windows Experience Blog says Windows uses MDASH and warns customers of higher update volume.
• July 14, 2026 (Patch Tuesday) — 569 CVEs, "the largest Patch Tuesday release ever," per Tenable.
• August 11, 2026 (Patch Tuesday) — 398 CVEs, per Tenable.
• August 13, 2026 — Microsoft AI announces MAI-Cyber-1-Flash, a compact security model built to handle most MDASH tasks.
• September 8, 2026 (Patch Tuesday) — 964 CVEs per Tenable (974 per Infosecurity Magazine), including two exploited zero-days.
• October 7, 2026 — FORGE publishes its three lessons and figures.

What we know

The Windows figures. Microsoft states that "FORGE helped discover Windows vulnerabilities assigned 140 common vulnerabilities and exposures (CVEs)" from May to September 2026, "including 52 addressed in September 2026's security release alone." A per-month breakdown appears only in a chart image: 16 in May, 10 in June, 27 in July, 35 in August and 52 in September. Microsoft adds that "monthly totals reflect announcement and servicing cohorts, not discovery dates or scan throughput" — in other words, the chart shows when fixes shipped, not when bugs were found.

The open-source figures. Over three months, according to the post, "FORGE members submitted 155 internally validated reports across 23 open-source projects, including the Linux kernel," and "93 reports across 14 projects or project families had documented maintainer acknowledgement or acceptance." An internal hackathon added another data point: "50 participants produced 39 reports across six projects." FORGE has also submitted nine Linux findings with internally assessed CVSS scores above 7.0.

The Linux kernel cost study. Microsoft says MDASH "surfaced thousands of suspicious locations in the Linux kernel" and that "validation agents produced supporting evidences for 627 findings." For a subset, it gives costs: "Across 182 confirmed crash findings, generating a PoC averaged $3.61 in model cost and 21.5 minutes." For six selected cases, automatic exploit generation (AEG) used to test local privilege escalation "averaged $8.56 and 25.4 minutes." The study used GPT-5.5, "without extensive task-specific tuning of either the model or the harness." Microsoft is explicit about what is left out: the averages "exclude initial screening, candidates that failed or were filtered out, and human investigation and patch preparation."

Disclosure. FORGE's Linux work helped test the early coordinated-disclosure workflow of Akrites, a Linux Foundation effort that describes itself as "a shared Security Incident Response Team (SIRT)" for open source. Microsoft says one FORGE report "was the first Akrites submission to result in a patch merged into the Linux kernel." Akrites' own site describes a four-step process — intake, deduplication and validation, remediation, synchronised disclosure — with all material held at TLP:RED until public disclosure.

Transparency. FORGE keeps a public, cumulative CVE index of identifiers "cleared for public disclosure." When we downloaded it on October 9, 2026, it listed 173 CVE IDs. Microsoft notes that "only subsets are publicly disclosed today."

The three lessons, in Microsoft's framing:

1. From frontier capability to scale. "Adding auditors can increase candidate volume without increasing the rate of validated findings or shipped fixes." The unit to optimise is a reproducible finding with enough evidence for the next stage.
2. From token consumption to reasoning economics. Reasoning should be spent to remove a specific uncertainty — a missing caller, a build configuration, a reproducer. Microsoft warns that "a larger search budget can even reduce useful throughput when duplicate or poorly supported reports consume attention that stronger findings need." One internal project "reduced about 45% duplicate findings across multiple scans of the same code" using deterministic methods such as abstract-syntax-tree comparison.
3. From isolated discovery to coordinated validation and remediation. "Human attention remains essential, but it should concentrate where judgment has the highest leverage": assessing impact, reviewing patches and checking whether a fix restores the component's intended invariant.

The Windows side. The July 9 Windows Experience Blog post says Windows uses "Microsoft Security's multi-model agentic scanning harness (MDASH)," that only the highest-confidence findings reach engineers, and that "customers will see a higher volume of security updates included in each security release." Its guidance to administrators: apply updates as soon as possible, test with the optional preview releases, use Known Issue Rollback, and move to "a more continuous, risk-based approach."

Technical analysis

The pipeline, conceptually. MDASH, as Microsoft has described it since May, runs prepare, scan, validate, dedupe and prove stages. Many cheap model calls flag suspicious code; other agents argue for and against reachability; a "prover" tries to build an input that actually triggers the bug. In August, Microsoft said its own MAI-Cyber-1-Flash model would handle "up to 90% of all tasks," with the hardest 10% escalated to larger frontier models. The October post shows that pipeline at production volume: thousands of suspicious kernel locations narrowed to 627 evidenced findings, 182 confirmed crashes in the costed subset, and nine high-severity submissions.

Why the funnel is the story. Each stage shrinks the set by roughly an order of magnitude. Microsoft does not publish a false-positive rate, but the shape of the funnel explains its first lesson. If scanning is cheap and validation is expensive, adding scanners makes the expensive stage the bottleneck. A crash proof for $3.61 sounds trivial — but that is the cost of successful cases only, with screening, failures and human work excluded. The true cost per shipped fix is unknown and almost certainly dominated by people.

What is new about the AI angle. Automated fuzzing has produced floods of crashes for years. What changes with language-model agents is that they produce explanations — plausible narratives about reachability and impact — as well as inputs. That is more useful when right and more costly when wrong, because a convincing but false report takes a maintainer longer to dismiss than a raw crash. Microsoft's emphasis on reproducible evidence, causal explanations and recording "why" a validation failed is a direct response to that.

Where the Patch Tuesday surge comes from. Our assessment: FORGE is only a slice of Microsoft's patch volume. Its chart attributes 52 Windows CVEs to the September release; Infosecurity Magazine counted 723 Windows CVEs that month, and Tenable counted 964 across all products. For June to September, FORGE's chart shows 124 CVEs against roughly 2,100 in Tenable's monthly totals — around 6%. The comparison is not like-for-like (Windows-only cohorts versus whole-portfolio counts), but it shows the surge cannot be explained by this one lab. The July Windows post says MDASH also uses third-party AI discovery models, and outside researchers have their own AI tools. Microsoft has not broken down where the rest of the volume came from.

Maintainers are the hidden control. The open-source numbers show the limit. Of 155 reports, 93 had documented acknowledgement. That gap is not a false-positive rate — some reports may be pending or simply unanswered — but it is the part of the system Microsoft cannot scale. "Maintainers sometimes differed on whether an issue crossed a security boundary," the post notes, and "some required a patch while others did not; some preferred private disclosure while others used public channels." Akrites' TLP:RED, deduplicate-first workflow is an attempt to give that chaos a single front door. Microsoft's commitment that research teams "absorb the resulting complexity rather than pass it on to maintainers" is the right norm; whether every AI-assisted finder follows it is another matter.

This complements what we reported on Anthropic's Glasswing tally of 129,000 AI-found flaws and Google's finding that AI-discovered bugs more often allow code execution: three large defenders now describe the same curve from different ends.

What remains unclear

• False positives. Microsoft gives no rejection or false-positive rate for Windows or open source. It names "rejected reports" and "failed reachability claims" as signals to track but does not quantify them.
• Full cost. The cost figures cover successful cases only. Microsoft does not say what a validated finding or a shipped fix costs end to end, including engineer time.
• The rest of the surge. How much of the jump from 198 to 964 CVEs per month comes from FORGE, from other Microsoft AI tooling, from third-party models or from external reporters is not disclosed.
• Counting differences. Tenable (964) and Infosecurity Magazine (974) disagree on September's total; neither explains its counting basis.
• The monthly chart. The FORGE chart's critical/important splits do not add up for May (4 + 23 against a total of 16), so we do not report them.
• Which kernel bug. The first Akrites-merged kernel patch is linked in the post but we could not retrieve the kernel mailing-list message; we do not know the subsystem or severity.
• Exploitation. Microsoft does not say whether any FORGE-found Windows bug was exploited before it was fixed. Tenable lists two exploited zero-days in September's release; nothing links them to FORGE.

Lessons and what to do

For security and IT operations teams

• Treat several-hundred-CVE Patch Tuesdays as the new baseline, not an anomaly. Monthly "test everything, deploy in week three" cycles do not scale to 900+ CVEs.
• Follow Microsoft's own advice: prioritise by exposure and asset value using the Security Update Guide, test with the optional preview releases, and know how to use Known Issue Rollback before you need it.
• Track your mean time to patch on internet-facing and identity systems separately; that is where a fast-moving defender advantage turns into an attacker advantage if updates sit in a queue.

For open-source maintainers and AI builders

• If you run AI-assisted bug hunting, measure validated findings and merged fixes, not candidates. Microsoft's 45% duplicate reduction from simple deterministic checks is a cheap first win.
• Send reports with a reproducer, a causal explanation and a severity rationale — or don't send them. Respect each project's disclosure preference.
• Maintainers of widely used components should look at coordinated channels such as Akrites, and publish a short SECURITY.md stating what they consider a security boundary.

For leadership

• Budget for remediation capacity, not just detection tooling. Microsoft's central claim is that the binding constraint has moved to people who validate and fix.
• Ask vendors that advertise AI-found vulnerability counts for the funnel: candidates, validated, acknowledged, fixed, and false-positive rate. A number without the funnel says little.

Sources

• Microsoft Security Blog, Taesoo Kim, "3 lessons from frontier AI vulnerability research," October 7, 2026.
• Microsoft FORGE Lab, public CVE index (cve.json) and repository, accessed October 9, 2026.
• Microsoft Security Blog, "Defense at AI speed: Microsoft's new multi-model agentic security system tops leading industry benchmark," May 12, 2026.
• Windows Experience Blog, "Evolving Windows vulnerability management to meet the speed of AI-powered discovery," July 9, 2026.
• Microsoft AI, "Introducing MAI-Cyber-1-Flash inside MDASH," August 13, 2026.
• Akrites / Linux Foundation, akrites.org.

Coverage:

• Tenable, "Microsoft's July 2026 Patch Tuesday addresses 569 CVEs," July 14, 2026.
• Tenable, "Microsoft's August 2026 Patch Tuesday addresses 398 CVEs."
• Tenable, "Microsoft's September 2026 Patch Tuesday addresses 964 CVEs," September 8, 2026.
• Infosecurity Magazine, "Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026," September 9, 2026.