Microsoft's AI Lab Finds Hundreds of Flaws, but Fixing Them Fast Is the Real Challenge

Microsoft Security's Frontier Offensive Research & Generative Exploitation (FORGE) Lab is building AI-native methods for finding and fixing previously unknown software vulnerabilities. According to Microsoft, from May 2026 through September 2026 the lab helped discover Windows vulnerabilities that were assigned 140 CVEs, including 52 addressed in the September 2026 security release alone.

The work extends beyond Windows. FORGE members submitted 155 internally validated reports across 23 open-source projects, including the Linux kernel. Through Akrites, a Linux Foundation initiative that coordinates confidential remediation and disclosure for critical open-source software, one Linux report became the first Akrites submission to result in a patch merged into the Linux kernel. The lab uses a multi-model agentic scanning harness, codenamed MDASH, to organise this research.

Microsoft's main message is that finding flaws is no longer the only hurdle. Discovery creates security value only when validation and remediation can keep pace. The post notes that the scarce resource is not always model intelligence; it can be a working build and deployment, a reproducible trigger, or an engineer's time. For security leaders, the question is whether an organisation can validate and fix vulnerabilities as fast as they are found. This summary covers only the opening of Microsoft's article, which goes on to describe three lessons in more detail.