Key Takeaways
- • Microsoft's MDASH, a multi-model agentic AI security system, achieved an 88.45% success rate on the CyberGym public benchmark comprising 1,507 real-world vulnerability reproduction tasks, placing it at the top of the industry leaderboard.
- • MDASH discovered 16 critical vulnerabilities in Windows systems, including 4 remote code execution (RCE) bugs in the TCP/IP networking stack, Internet Key Exchange (IKE) version 2, Netlogon services, and DNS API library, with the majority reachable from network positions requiring no credentials.
- • The Autonomous Code Security Team behind MDASH includes members from Team Atlanta at Georgia Tech, which won a $20 million prize in the DARPA AI Cyber Challenge competition; Taesoo Kim, a Georgia Tech professor currently on leave with Microsoft, leads the initiative.
- • In an internal validation test using the StorageDrive driver with 21 deliberately injected vulnerabilities, MDASH identified all vulnerabilities with zero false positives, demonstrating high precision on novel code not present in large language model training data.
- • All 16 identified vulnerabilities were patched in April and May 2026, with 10 in kernel mode and 6 in user mode, representing a significant advancement in AI-accelerated vulnerability discovery and remediation timelines.
Summary
Microsoft has announced MDASH, a multi-model agentic AI system designed to discover and validate exploitable vulnerabilities at scale. The system achieved a decisive 88.45% success rate on the CyberGym public benchmark, which evaluates AI agents on 1,507 real-world vulnerability reproduction tasks sourced from 188 projects in Google's OSS-Fuzz program. This performance places MDASH at the top of the current industry leaderboard, marking a significant advancement in AI-driven cybersecurity capabilities.
The practical impact of MDASH has been demonstrated through its discovery of 16 vulnerabilities in critical Windows systems. Four of these were classified as critical remote code execution bugs affecting the TCP/IP networking stack, Internet Key Exchange (IKE) version 2, Netlogon services, and the DNS API library. An additional 12 vulnerabilities were identified across these same systems. Of particular significance, the majority of these vulnerabilities are reachable from a network position and require no credentials for exploitation, representing severe security exposure. Microsoft patched all 16 vulnerabilities in April and May 2026, with 10 residing in kernel mode and 6 in user mode.
The technical foundation behind MDASH reflects Microsoft's strategic investment in autonomous security research. The Autonomous Code Security Team includes members from Team Atlanta at Georgia Tech, which secured a $20 million prize in the United States Defense Advanced Research Projects Agency's (DARPA) AI Cyber Challenge competition. Taesoo Kim, a Georgia Tech professor currently on leave with Microsoft, leads this initiative and serves as Vice President of Agentic Security.
Validation testing on an internal StorageDrive driver provided further evidence of MDASH's precision. In this test using code deliberately seeded with 21 vulnerabilities and not present in large language model training data, MDASH achieved 100% detection with zero false positives. This performance suggests the system can effectively identify novel vulnerabilities without reliance on patterns in standard training datasets. Microsoft's approach aligns with broader industry trends toward AI-accelerated vulnerability discovery and reduced time-to-mitigation in security operations.
The practical impact of MDASH has been demonstrated through its discovery of 16 vulnerabilities in critical Windows systems. Four of these were classified as critical remote code execution bugs affecting the TCP/IP networking stack, Internet Key Exchange (IKE) version 2, Netlogon services, and the DNS API library. An additional 12 vulnerabilities were identified across these same systems. Of particular significance, the majority of these vulnerabilities are reachable from a network position and require no credentials for exploitation, representing severe security exposure. Microsoft patched all 16 vulnerabilities in April and May 2026, with 10 residing in kernel mode and 6 in user mode.
The technical foundation behind MDASH reflects Microsoft's strategic investment in autonomous security research. The Autonomous Code Security Team includes members from Team Atlanta at Georgia Tech, which secured a $20 million prize in the United States Defense Advanced Research Projects Agency's (DARPA) AI Cyber Challenge competition. Taesoo Kim, a Georgia Tech professor currently on leave with Microsoft, leads this initiative and serves as Vice President of Agentic Security.
Validation testing on an internal StorageDrive driver provided further evidence of MDASH's precision. In this test using code deliberately seeded with 21 vulnerabilities and not present in large language model training data, MDASH achieved 100% detection with zero false positives. This performance suggests the system can effectively identify novel vulnerabilities without reliance on patterns in standard training datasets. Microsoft's approach aligns with broader industry trends toward AI-accelerated vulnerability discovery and reduced time-to-mitigation in security operations.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.