Microsoft FORGE Shares Lessons from AI-Assisted Vulnerability Research at Scale
Summary
Microsoft says its FORGE Lab helped identify Windows vulnerabilities assigned 140 CVEs and submitted 155 validated reports across 23 open-source projects. The team emphasizes scaling validation and remediation alongside AI-assisted discovery.
Key points
- From May through September 2026, FORGE helped discover Windows vulnerabilities assigned 140 CVEs, including 52 addressed in September’s security release.
- The team submitted 155 internally validated reports across 23 open-source projects; 93 reports across 14 projects or project families had maintainer acknowledgement or acceptance.
- One FORGE Linux report was the first Akrites submission to result in a patch merged into the Linux kernel.
- Microsoft argues that increased vulnerability-finding volume can overwhelm review and remediation; throughput depends on reproducible evidence, deduplication, and capacity to validate and fix findings.
- FORGE’s MDASH system combines models, specialized auditors, and code-analysis tools, with validation outcomes and reviewer feedback intended to improve future scans.
- In a Linux-kernel evaluation, proof-of-concept generation for 182 confirmed crash findings averaged $3.61 in model cost and 21.5 minutes per successful case; the figures exclude screening and human investigation.
Article Details
- Topic
- Microsoft FORGE Lab’s use of agentic AI for vulnerability discovery, validation, and remediation across Windows and open-source projects.
CVE
CVE-2026-13608Since the reports are at different stages of that process, only subsets are publicly disclosed today, such as curl’s CVE-2026-9545 and CVE-2026-13608, Node.js’s CVE-2026-56848, and Linux kernel CVE-2026-64563.CVE-2026-56848Since the reports are at different stages of that process, only subsets are publicly disclosed today, such as curl’s CVE-2026-9545 and CVE-2026-13608, Node.js’s CVE-2026-56848, and Linux kernel CVE-2026-64563.CVE-2026-64563Since the reports are at different stages of that process, only subsets are publicly disclosed today, such as curl’s CVE-2026-9545 and CVE-2026-13608, Node.js’s CVE-2026-56848, and Linux kernel CVE-2026-64563.CVE-2026-9545Since the reports are at different stages of that process, only subsets are publicly disclosed today, such as curl’s CVE-2026-9545 and CVE-2026-13608, Node.js’s CVE-2026-56848, and Linux kernel CVE-2026-64563.
People
Vendors
Products
Gemini CLIWith MDASH and supporting guidance, 50 participants produced 39 reports across six projects, including Microsoft’s open-source Hyperlight project, Linux, vLLM, Gemini CLI, and llama.cpp.GPT-5.5Per-case averages reflect all attempts for successful cases using GPT-5.5.Linux kernelThis post reflects those principles in practice across Windows, the Linux kernel, and widely used open-source projects.Microsoft WindowsThis post reflects those principles in practice across Windows, the Linux kernel, and widely used open-source projects.
Tools
AkritesAkrites: Coordinated effort to remediate vulnerabilitiesCyberGymThe frontier question is whether a system can find a bug that demands deep reasoning, as we explored in our early work on the CyberGym benchmark.MDASHAt FORGE Lab, we use the multi-model agentic scanning harness, codename MDASH, to organize this work.