Microsoft FORGE reported AI-assisted vulnerability discovery with validation bottlenecks

Microsoft's FORGE results show why finding a suspicious code path, validating a vulnerability and shipping a repair need separate accounting. In its October 7 report, Microsoft describes 140 assigned Windows CVEs from May through September and 155 internally validated open-source reports across 23 projects. Those totals represent different populations and stages of review.

The workflow uses agents to identify candidates and develop reproductions, then relies on validation and reviewer feedback to distinguish genuine findings from failures and duplicates. Component teams and maintainers still determine acceptance and servicing. Of the 155 open-source reports, 93 across 14 projects or project families had documented maintainer acknowledgement or acceptance at publication. The 39 hackathon reports were already included in the 155. Neither acknowledgement nor an internal reproduction means a fixed version reached every downstream user.

The cost figures describe a narrower successful subset. Microsoft's measurement averages $3.61 in model cost and 21.5 minutes across 182 successful crash cases using GPT-5.5. It includes all attempts associated with those successful cases, while excluding initial screening, failed or filtered candidates, human investigation and patch preparation. Dividing those figures into a security team's budget would therefore omit substantial work.

The supported conclusion is that automated generation and validation can operate at useful scale in the reported program, while acceptance and remediation remain separate constraints. The report does not establish an all-in cost per serviced vulnerability, independent reproduction of the entire portfolio or a uniform fix state. Its contribution is evidence about an AI-assisted research process, not a count of organizations compromised by the resulting findings.