Microsoft Deploys 100+ AI Agents to Find Windows Vulnerabilities
Microsoft created a system with more than 100 specialized AI agents to identify software vulnerabilities. Named MDASH, short for Multi-Model Agentic Scanning Harness, it targets flaws in code automatically. The company already used it to spot 16 new issues in Windows.
On May 12, 2026, during Patch Tuesday, Microsoft detailed these 16 vulnerabilities, known as CVEs, in the Windows networking and authentication stack. Four count as critical. They include remote code execution problems in tcpip.sys kernel component, IKEv2 service in ikeext.dll, netlogon.dll, and dnsapi.dll.
Ten vulnerabilities hit kernel mode. Most allow access over networks without authentication. Microsoft notes its code, including Windows, Hyper-V, and Azure, proves tough to check because it stays proprietary and outside public training data for AI models.
MDASH Pipeline Explained
MDASH runs through four stages. It starts by examining source code and outlining the attack surface. Next, auditor agents review code for risky spots. Then debaters argue if each potential issue can be exploited, with some supporting and others challenging. Duplicates get combined. Finally, Evidence Leader agents try to activate flaws using crafted inputs.
The setup stays open to any models. Teams can swap in new ones easily via configuration changes. Plugins add expert knowledge on topics like kernel calling conventions or IPC trust boundaries, details foundation models lack.
Record Score on CyberGym Benchmark
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
MDASH reached 88.45 percent on the CyberGym benchmark, which tests against 1,507 real vulnerabilities. That marks the highest public leaderboard score, about five points above the runner-up. Still, the match pits a full framework against single models, which might improve similarly in such a setup.
Microsoft avoids naming exact models. It mentions state-of-the-art models for heavy reasoning, distilled versions for cheap debating, and a separate state-of-the-art model for checks. Sources could include OpenAI, Anthropic, Microsoft labs, or others.
Team Background and Access
Microsoft's Autonomous Code Security Team supports MDASH. Some members hail from Team Atlanta, which won the DARPA AI Cyber Challenge. There, they developed a system to find and repair bugs in complex open-source software.
MDASH offers limited private preview to select external customers now. A full technical report sits on the Microsoft blog.
Other firms, including OpenAI and Anthropic, advance AI for cybersecurity. They seek to counter threats partly fueled by AI advances.
Microsoft, a leader in operating systems since launching Windows in 1985, invests heavily in security amid rising cyber risks. Patch Tuesday delivers monthly fixes for Windows users worldwide. Benchmarks like CyberGym help measure tools against known flaws from real systems. DARPA challenges push AI limits in defense tech, influencing commercial tools.