Microsoft has announced a new multi-model agentic security system that it says helped researchers identify 16 vulnerabilities across the Windows networking and authentication stack. The system, known by the codename MDASH, combines specialized AI agents, multiple models and a staged validation process rather than relying on a single model to inspect code from start to finish.
The announcement matters because it places AI vulnerability discovery inside a security engineering workflow, where findings must be investigated, reproduced and handed to developers. Microsoft says the work uncovered four Critical remote code execution vulnerabilities, including issues affecting components such as the Windows kernel TCP/IP stack and the IKEv2 service. The company presents MDASH as an internal capability being used by security engineers and evaluated through a limited private preview, not as a generally available scanning product.
Why Microsoft built a system around several models
Microsoft’s central argument is that vulnerability research is too varied for one model or one prompt. Different tasks require different kinds of reasoning: mapping an attack surface, finding suspicious code paths, challenging an initial hypothesis, reproducing a bug and determining whether separate findings are duplicates.
MDASH divides that work into five stages. The preparation stage builds language-aware indexes and maps the target’s threat model. During scanning, specialized auditor agents inspect candidate paths and produce findings with supporting evidence. A validation stage uses another group of agents to argue for and against reachability and exploitability. Deduplication then collapses findings that describe the same underlying issue. Finally, the proving stage constructs and executes triggering inputs where the bug class allows it, helping distinguish a plausible warning from a reproducible vulnerability.
Microsoft says the harness coordinates more than 100 specialized agents across an ensemble of frontier and distilled models. Each agent has a defined role, prompt regime, tool set and stopping condition. The company’s technical account of MDASH describes the model as one input to a broader system, rather than the product itself.
What the disclosed evaluations show
Microsoft reports three different types of evaluation. In a private test driver called StorageDrive, the harness found all 21 deliberately injected vulnerabilities and produced no false positives in that run. The test driver had not been publicly released, which Microsoft says reduced the risk that a model had simply encountered the answers during training.
The company also conducted retrospective tests against confirmed Microsoft Security Response Center cases. MDASH recovered 96% of 28 historical cases in clfs.sys and 100% of seven cases in tcpip.sys, covering five years of previously confirmed vulnerabilities. These figures are useful signals about recall on selected internal code, but they are not a forecast of how the system will perform on every future component or codebase.
On the public CyberGym benchmark, Microsoft reports an 88.45% success rate across 1,507 real-world vulnerability reproduction tasks drawn from 188 OSS-Fuzz projects. The company says that result was the highest score on the published leaderboard at the time of writing and roughly five percentage points ahead of the next entry. The evaluation used generally available models, while the harness was extended to submit proof-of-concept inputs through CyberGym’s protocol.
From candidate finding to security result
The distinction between discovery and proof is the most important operational point in Microsoft’s announcement. A scanner that generates a large number of plausible findings can increase pressure on security teams if those findings cannot be reproduced or prioritized. MDASH is designed to keep candidates moving through triage, deduplication and proof before they become engineering work.
Microsoft says the disclosed Windows findings were produced through collaboration between its Autonomous Code Security team, Microsoft Offensive Research and Security Engineering, and Windows Attack Research and Protection. The resulting issues were handled through Microsoft’s existing security response process. That connection to ownership, patching and release management is what turns an AI-generated hypothesis into a defensive outcome.
The architecture also uses domain-specific plugins. Microsoft describes extensions that provide context about kernel conventions, filesystem structures and other implementation details that general-purpose models cannot reliably infer. This suggests that the practical value of agentic security may depend as much on curated tools, code context and validation harnesses as on the underlying model.
The limits behind the headline
The results should still be read with care. The private driver test involved 21 known planted flaws, the historical recall figures came from two Microsoft components, and the CyberGym result followed a defined benchmark configuration. None of these measurements establishes that MDASH will find vulnerabilities at the same rate in unrelated proprietary or open-source projects.
Microsoft also acknowledges that benchmark descriptions and input formats affect outcomes. In its remaining CyberGym failures, the company identified cases where vague task descriptions led agents to the wrong code area, as well as cases where generated inputs did not match the required fuzzing format. These details underline why human review, reproducible evidence and project-specific tooling remain necessary.
For defenders, the announcement’s broader lesson is not that one AI model has solved vulnerability research. It is that a carefully engineered pipeline can make model disagreement, staged reasoning and automated proof part of the security process. The useful question is therefore how an AI system validates and operationalizes its findings, how it handles false positives, and whether its workflow can absorb new models without rebuilding the surrounding controls.