3 Lessons from Frontier AI Vulnerability Research
Microsoft, Wednesday, October 7th, 2026
Microsoft's FORGE Lab found Windows flaws behind 140 CVEs since May and shares three lessons on scaling AI vulnerability research.
Microsoft Security's FORGE Lab helped discover Windows vulnerabilities assigned 140 CVEs from May through September 2026, including 52 in the September security release, using the multi-model agentic scanning harness codenamed MDASH.
Members also submitted 155 validated reports across 23 open-source projects, and one Linux report became the first Akrites submission to produce a merged kernel patch.
The post outlines three shifts: from frontier capability to scale, from token consumption to reasoning economics, and from isolated discovery to coordinated validation and remediation.