{"id":905,"date":"2026-05-13T14:38:00","date_gmt":"2026-05-13T14:38:00","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=905"},"modified":"2026-05-13T14:38:00","modified_gmt":"2026-05-13T14:38:00","slug":"microsofts-mdash-ai-system-finds-16-windows-flaws-fixed-in-patch-tuesday","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=905","title":{"rendered":"Microsoft’s MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 13, 2026<\/span><\/span>Vulnerability \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has unveiled a new multi-model artificial intelligence (AI)-driven system called MDASH<\/strong> to facilitate vulnerability discovery and remediation at scale, adding that it’s being tested by some customers as part of a limited private preview.<\/p>\n

MDASH, short for m<\/strong>ulti-mod<\/strong>el a<\/strong>gentic s<\/strong>canning h<\/strong>arness, is designed as a model-agnostic system that uses bespoke AI agents for different vulnerability classes to autonomously discover, validate, and prove exploitable defects in complex codebases like Windows.<\/p>\n

\u00abUnlike single-model approaches, the harness orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end,\u00bb Taesoo Kim, vice president of agentic security at Microsoft, said<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

MDASH is envisioned as a \u00abstructured pipeline\u00bb that ingests a codebase and produces validated, proven findings through a series of actions.<\/p>\n

It starts with analyzing the source code to build a threat model and attack surface, running specialized \u00abauditor\u00bb agents over candidate code paths to flag potential issues, running a second set of \u00abdebater\u00bb agents that validate the findings, grouping semantically equivalent findings, and then finally proving the existence of the vulnerabilities.<\/p>\n

The system is powered by a configurable panel of models, with state-of-the-art (SOTA) models used for reasoning, distilled models for validation for high-volume passes, and a second separate SOTA model for independent counterpoint.<\/p>\n

\u00abDisagreement between models is itself a signal: when an auditor flags something as suspect and the debater can’t refute it, that finding\u2019s posterior credibility goes up,\u00bb Microsoft explained. \u00abAn auditor does not reason like a debater, which does not reason like a prover. Each pipeline stage has its own role, prompt regime, tools, and stop criteria.\u00bb<\/p>\n

Redmond noted that the specialized agents have been constructed based on past common vulnerabilities and exposures (CVEs) and their patches. It also said the architecture allows for portability across model generations.<\/p>\n

\"\"<\/a><\/div>\n

MDASH has already been put to test, unearthing 16 of the vulnerabilities that were fixed in this month’s Patch Tuesday release. The shortcomings span across the Windows networking and authentication stack, including two critical flaws that could pave the way for remote code execution –<\/p>\n