Microsoft MDASH: 100 AI Agents Found 16 Windows Flaws
Agentic AIMicrosoft’s new MDASH system deployed more than 100 AI agents against its own Windows codebase and found 16 previously unknown vulnerabilities in a single operational run — including four critical remote code execution flaws patched in May 2026 Patch Tuesday.
The Adversarial Architecture
MDASH — Microsoft’s multi-model agentic scanning harness — stages agents against each other’s claims rather than running a single model pass. Some agents scan source code for potential flaws. Others challenge those findings, validating whether a reported issue is a genuine vulnerability or noise. A final stage constructs triggering inputs capable of reproducing the issue end-to-end, proving exploitability rather than just flagging suspicious patterns.
The adversarial structure is intentional: agents that disagree with each other produce dramatically fewer false positives than single-model approaches that have no internal challenge mechanism. The result is a system that can be deployed at scale without requiring a human researcher to triage every output.
The 16 discovered vulnerabilities span the Windows TCP/IP stack, IKEEXT (the IPsec key exchange service), HTTP.sys, Netlogon, DNS resolution, and the Telnet client. Ten were in kernel mode, six in user mode. Most were reachable from a network position without credentials — the profile of a remotely exploitable flaw that doesn’t require the attacker to already be inside the environment.
What the Benchmark Numbers Show
Microsoft validated MDASH against both controlled and historical data before deploying it on live code. On a private test driver seeded with known planted bugs, MDASH found all 21 with zero false positives. Against five years of confirmed Microsoft Security Response Center cases in clfs.sys, recall hit 96%; against tcpip.sys cases, it reached 100%.
On the public CyberGym benchmark — the current standard for evaluating autonomous security tools against real-world attack scenarios — MDASH scored 88.45%, topping the leaderboard. Unlike benchmarks that test against synthetic problems, CyberGym uses scenarios modeled on genuine offensive behavior. Reaching 88.45% on that test is a substantially different claim than performing well in sandboxed code review environments.
The Pattern
Stack Archive has tracked seven posts on agentic AI operating in security contexts — from AI agents shrinking the window between vulnerability discovery and exploit deployment (/blog/ai-patch-exploit-disclosure-window-2026) to autonomous systems doubling their offensive capability benchmarks year-over-year. MDASH closes a distinct loop: agents that find, verify, and prove zero-day vulnerabilities without a human researcher in the validation chain.
The So What
MDASH enters enterprise private preview in June. For security teams, the implication is architectural: vulnerability discovery is shifting from a human-bottlenecked research function to an agentic pipeline that runs continuously against production code. The adversarial ensemble design — agents that argue with each other before escalating a finding — is what drives precision. Single-model scanning still produces too many false positives to be operationally actionable; multi-agent adversarial systems do not. The question for enterprise security programs is no longer whether AI belongs in vulnerability discovery, but what the right agent count and challenge structure is before a finding reaches a human researcher.
Photo by Tima Miroshnichenko on Pexels
Source: The Decoder
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →