Microsoft's MAI-Cyber-1-Flash AI tool targets surging software vulnerabilities

Microsoft has unveiled MAI-Cyber-1-Flash, a new AI security tool designed to help organizations manage the exploding number of software vulnerabilities. The launch follows a record-breaking first half of 2026, with 45,207 flaws logged in the US National Vulnerabilities Database—nearly double the entire 2025 tally. Oracle patched 1,449 vulnerabilities in July (its highest ever), Microsoft disclosed 642 bugs (5x last July), and Google fixed 433 Chrome flaws (mostly self-reported). The surge is driven by increasingly capable AI models used both by security teams and attackers.

AI tools like Anthropic's Mythos can now find thousands of vulnerabilities automatically, while exploit development time has dropped from 72 hours to just 24 hours. Despite fears of an attack wave, exploited vulnerabilities haven't risen proportionally—partly because internal AI tools help firms discover and patch flaws before criminals can weaponize them. Microsoft's MAI-Cyber-1-Flash is aimed at integrating AI into vulnerability management workflows, allowing security teams to triage and remediate the influx efficiently. The tool represents a critical step in the cybersecurity arms race as AI accelerates both discovery and exploitation.