Microsoft's MDASH uses 100+ AI agents to find Windows bugs faster
Microsoft's new AI pipeline already discovered 16 vulnerabilities, 4 critical—patched in May.
Microsoft has unveiled a major shift in its Windows security strategy, leveraging AI to find and fix vulnerabilities faster than ever. The centerpiece is MDASH (Multi-Model Agentic Scanning Harness), a cloud-based pipeline developed by the Microsoft Autonomous Code Security team. MDASH orchestrates over 100 specialized AI agents across an ensemble of frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end. The system already demonstrated its effectiveness: in May, it identified 16 vulnerabilities, four rated Critical, all of which were patched in that month's security update.
The new approach marks a departure from traditional manual vulnerability research. By applying AI to pattern recognition across the Windows codebase, Microsoft aims to shrink the window between discovery and patch deployment, reducing the opportunity for zero-day attacks. The company is also updating its Secure Development Lifecycle best practices to account for AI-enabled attack techniques, integrating vulnerability discovery earlier into the development process. Importantly, Microsoft emphasizes that human expertise remains central—engineers review findings, make risk-based decisions, and ensure quality before updates ship. This comes as Microsoft reportedly offers a voluntary retirement program to about 7% of its US workforce, raising questions about retaining experienced staff amid increasing automation.
- MDASH uses over 100 specialized AI agents to scan Windows code and find vulnerabilities at scale, with reduced false positives.
- In its first deployment, MDASH discovered 16 vulnerabilities (4 Critical) that were all patched in the May security update.
- Microsoft is embedding AI earlier in its Secure Development Lifecycle to catch issues before features ship, while keeping human reviewers in the loop.
Why It Matters
AI-driven vulnerability discovery means faster patches for Windows’ 1.5+ billion devices, raising the bar against zero-day attacks.