Microsoft’s MDASH System Finds 16 Windows Vulnerabilities Using AI Agents

MDASH vulnerability discovery, Microsoft’s multi-model agentic scanning harness, identified 16 new vulnerabilities across the Windows networking and authentication stack, including four critical remote code execution flaws. The system, built by Microsoft’s Autonomous Code Security team, orchestrates more than 100 specialized AI agents to discover and validate exploitable bugs across frontier and distilled models.

The MDASH vulnerability discovery system achieved a score of 88.45% on the public CyberGym benchmark, ranking highest on the leaderboard ahead of the second-place entry by approximately five points. In controlled testing on StorageDrive, a private device driver containing 21 deliberately injected vulnerabilities, the system identified all 21 bugs with zero false positives. Historical analysis showed 96% recall on 28 confirmed cases in clfs.sys spanning five years and 100% recall on seven cases in tcpip.sys.

How MDASH Vulnerability Discovery Works

The system operates through a structured pipeline consisting of five distinct stages. The prepare stage ingests source code, builds language-aware indices, and analyzes past commits to identify attack surface and threat models. The scan stage runs specialized auditor agents over candidate code paths to emit findings with hypotheses and evidence.

A validation stage deploys debater agents that argue for and against each finding’s reachability and exploitability. The dedup stage collapses semantically equivalent findings through patch-based grouping. Finally, the prove stage constructs and executes triggering inputs to validate vulnerabilities dynamically, using techniques such as AddressSanitizer in C/C++ to confirm bug existence.

The architecture employs three key properties: an ensemble of diverse models managed by MDASH rather than relying on any single model; more than 100 specialized agents, each with its own role, prompt regime, and tools tailored to specific pipeline stages; and an end-to-end pipeline with extensible plugins that allow domain experts to inject context foundation models cannot access independently, such as kernel calling conventions and lock invariants.

Critical Vulnerabilities Found in May 2026 Patch Tuesday

The May 12, 2026 Patch Tuesday included 16 CVEs discovered by MDASH across Windows components. CVE-2026-33827 involved a remote unauthenticated use-after-free in tcpip.sys triggered by crafted IPv4 packets with the Strict Source and Record Route option. The vulnerability arose from improper lifetime management of a reference-counted Path object due to a race condition in the path cache cleanup routines on symmetric multiprocessing systems.

CVE-2026-33824 represented a critical flaw in the IKEEXT service, the Windows component handling IKE and AuthIP keying for IPsec. An unauthenticated remote attacker could send a crafted IKE_SA_INIT message followed by a single IKEv2 fragment to trigger a deterministic double-free of a 16-byte heap allocation. Because IKEEXT runs as LocalSystem inside svchost.exe, this provided a pre-authentication remote code execution path into one of the highest-privilege contexts on the system.

The root cause was a shallow memcpy operation that duplicated a packet’s receive context without copying the heap allocations it referenced. Both the queued context and the live Main Mode Security Association held the same pointer and both believed they owned it, resulting in a double-free on teardown. The vulnerability required only two UDP packets to trigger with no race condition or special timing needed.

Why Single-Model Systems Missed These Bugs

The CVE-2026-33827 vulnerability escaped detection by single-model systems because the lifetime violation was not locally visible within the same function. The release of the Path reference and its later reuse were separated by non-trivial control flow including alternate branches, multiple validation checks, and several early-drop conditions. Without tracking reference ownership across these intermediate states, a single model sees two independent operations rather than a temporal dependency.

The decisive signal also existed outside immediate context. The same logical operation appeared elsewhere with the correct order, making the vulnerable call-site an inconsistency rather than an obvious misuse. Detecting this required cross-file reasoning to identify analogous patterns, align their intent, and notice the deviation. Reachability also depended on composing multiple conditions: an input setting the SSRR flag, default configuration allowing the path, and concurrent subsystems reclaiming the object during the exposed window.

The CVE-2026-33824 artificial intelligence finding spanned six source files across ike_A.c through ike_F.c. No single-file analysis could detect it. The strongest evidence that the bug was real was the correct version of the same pattern in ike_D.c. Catching this required auditor agents to surface comparisons and have the debate stage force them to stand up under cross-examination.

Industry Implications and Future Capability

Microsoft stated that AI-powered vulnerability discovery has transitioned from research curiosity into production-grade defense at enterprise scale. The durable advantage lies in the agentic system around the model rather than any single model itself. MDASH is currently being used by Microsoft security engineering teams and tested by a small set of customers as part of a limited private preview.

The team emphasized that discovery requires composition no single prompt can achieve. The cybersecurity bugs identified are not visible to a model examining a single function. They are visible to a system sequencing cross-file pattern comparison, multi-step reachability analysis, debate between specialized agents, and end-to-end proof construction. The architecture absorbs model improvements because targeting, debating, dedup, and proof stages do not require rewriting when a new model arrives; only configuration changes and A/B testing are needed.