Microsoft said Wednesday that vulnerabilities found by its AI-driven research system led to 140 Windows CVEs fixed in Patch Tuesday releases from May through September, including 52 in the September release alone. In a post on the Microsoft Security Blog, Taesoo Kim, the company's vice president of agentic security, said the hard part has moved from finding bugs to proving which reports are real and worth fixing.

What Happened

The work comes from Microsoft's FORGE Lab, short for Frontier Offensive Research & Generative Exploitation, which uses a system called MDASH. Microsoft describes MDASH as a multi-model agentic scanning harness that combines frontier and smaller distilled models with specialized auditors and code-analysis tools to find zero-day flaws and coordinate fixes.

Beyond Windows, the team submitted 155 internally validated reports to 23 open-source projects. At the time of writing, maintainers had acknowledged or accepted 93 of them across 14 project families. Thirty-nine of those reports came from Project Sunshine, an internal hackathon in which 50 participants worked across six projects.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

Microsoft also sent nine Linux findings with CVSS severity scores above 7.0 to Akrites, a Linux Foundation initiative for coordinating confidential fixes. One became the first Akrites submission to produce a patch merged into the Linux kernel, the company said.

The post includes cost figures for automated validation on Linux kernel findings using OpenAI's GPT-5.5. Across 182 confirmed crashes, generating a working proof of concept averaged $3.61 and 21.5 minutes per case. In six selected cases where the model tested whether a bug could be turned into a local privilege-escalation exploit, the average was $8.56 and 25.4 minutes.

Why It Matters

AI tools are producing vulnerability reports faster than many software teams can review them, and open-source maintainers in particular have complained about floods of unverified submissions. Microsoft's post takes a position on who should carry that load. Kim wrote that open-source security research can scale only if research teams absorb the added complexity "rather than pass it on to maintainers."

The cost figures are the core of Microsoft's argument for automated validation. By its numbers, a few dollars and about 20 minutes of compute buys a reproducible proof of concept before a report ever reaches a maintainer. Publishing per-case costs across 182 confirmed crashes also gives other security teams a rare reference point for budgeting similar pipelines.

Three Lessons

Kim framed the findings as three shifts. The first is from raw frontier capability to scale: finding bugs no longer guarantees impact, and project-specific automated provers that generate reproducible evidence cut the human triage needed to decide which reports are credible.

The second concerns what Microsoft calls reasoning economics. Rather than simply minimizing tokens, the system should spend expensive reasoning only where it reduces uncertainty, sending routine work to cheaper models and escalating unresolved questions to stronger ones.

The third treats remediation as part of discovery. Each investigation should leave behind reusable material, such as validated triggers, better test harnesses and regression tests, that feeds the next round of bug hunting.

What to Watch

Microsoft says FORGE will measure the full pipeline rather than raw finding counts, weigh model costs alongside human review time and track how many reports end in validated fixes and releases. Future Patch Tuesday totals attributed to MDASH, and how many of the open-source reports turn into merged patches, will show whether that approach holds up beyond the first five months.