Microsoft Discloses AI-Driven Vulnerability Discovery, Fixing Over 1,100 CVEs in October Windows Update
Microsoft states that its use of the MDASH AI agent for code scanning led to the fix of more than 1,100 CVEs in the October Windows security update.
US technology company Microsoft disclosed on November 5 via its official blog a new strategy for managing Windows system vulnerabilities in the AI era. The company stated that in its monthly security update for October, it fixed more than 1,100 Common Vulnerabilities and Exposures (CVEs) for Windows systems. While this number is significantly higher than previous months, Microsoft emphasized that this does not indicate a decline in Windows security, but rather reflects the benefits of broader AI-assisted detection.
Microsoft noted that attackers are increasingly using AI to find unpatched vulnerabilities or analyze released patches to quickly generate malware. As a defensive measure, Microsoft has expanded AI-driven vulnerability exploration across the entire Windows codebase. This process utilizes an agentic code scanner named "MDASH" to assist engineers at various stages, from discovery to remediation and verification. Although AI has significantly increased scanning efficiency, Microsoft stated that final judgments and decisions remain the responsibility of human engineers.
As AI accelerates vulnerability discovery, the time window after a patch release is also shrinking. Microsoft mentioned that once a fix is public, attackers may parse it and develop exploit code within hours. However, diagnostic data from August showed that more than half of enterprise Windows devices had not applied updates two weeks after a patch was released. Microsoft urged users to stay on supported versions of Windows and apply security updates promptly to counter the increasingly complex threat landscape.