Microsoft has warned customers to expect a surge in the number of security updates they will need to apply to Windows, as it uses cutting-edge AI techniques to find more zero-day vulnerabilities.
The tech giant claimed in a blog post on July 9 that it is applying AI to security analysis to “identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows codebase.”
“As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release,” it added. “This is evidence that defenders are getting better at identifying and addressing issues. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers.”
Read more on AI-powered security research: UK Government Finds 400+ Vulnerabilities in AI Hackathons
A key component of this new approach multi-model agentic scanning harness (MDASH), which uses several models to find novel vulnerabilities.
“To run MDASH at Windows scale, Windows set up dedicated cloud infrastructure for scanning and proving. A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families,” Microsoft explained.
“Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team. This automation helps handle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero-day exploits.”
Microsoft said it is also updating its Secure Development Lifecycle (SDL) best practices to take account of “AI-enabled attack techniques and exploit paths.”
However, it was at pains to point out that there would always be human oversight in the process, in order to maintain the high quality of updates.
AI is the Future of Vulnerability Scanning
The news comes after it emerged this week that the US Cybersecurity and Infrastructure Security Agency (CISA) is reportedly using Anthropic Fable to scan for vulnerabilities across government systems.
In April, CISA’s Lindsey Cerkovnik, who represents the agency on the CVE Board, called for frontier AI companies to play a bigger role in software vulnerability disclosures.
However, not everyone is convinced. A Cobalt study from June found that the percentage of organizations relying entirely on AI automation for vulnerability scanning plunged from 29% to 9% between 2025 and 2026.
Over three-quarters (78%) of respondents polled said fully automated scanning tools missed critical vulnerabilities.
AI is also part of the problem as well as the solution. A new Orca Security study published on July 9 claimed that 81% of organizations run vulnerable AI packages, and 99.9% of fixable AI vulnerabilities remain unpatched.
