The report
Microsoft's FORGE Lab reported 140 Windows CVEs attributed to its May through September 2026 vulnerability research, including 52 in the September servicing cohort. Across 23 open-source projects, the team submitted 155 internally validated vulnerability reports. It recorded maintainer acknowledgement or acceptance for 93 reports in 14 projects or project families at the October 7 publication cutoff. Those are different stages of the security workflow, not 140 plus 155 fixed vulnerabilities. Microsoft's original measurements distinguish CVEs, submitted reports and maintainer responses.
The denominator behind $3.61
FORGE also published a bounded cost experiment using GPT-5.5. For 182 confirmed Linux kernel crash findings, its automated agents generated proofs of concept at an average of $3.61 in model cost and 21.5 minutes per successful case. For six separately selected local privilege-escalation validation cases, the averages were $8.56 and 25.4 minutes. These include repeated attempts associated with successful cases, but exclude initial candidate screening, unsuccessful or filtered candidates, human investigation and patch preparation. The quoted cost is therefore not the expected all-in cost of finding and fixing an arbitrary vulnerability.
The lab described a pipeline that uses models, code-analysis tools, deduplication and execution-based validation to turn suspicious code into reproducible evidence. Its report says one Linux submission through the Akrites coordination program had reached a merged upstream kernel patch. Acknowledgement by another maintainer remains short of a verified patch and shipped downstream update.
What this measures, and what it does not
The comparison with CrowdStrike's controlled composition study is methodological, not a shared attack: generating working offensive code in nine test categories is not the same metric as verifying a crash, getting a CVE, or shipping a fix. FORGE's useful contribution is reporting a separate validation-stage denominator. The next figure needed for a complete economic assessment is the fraction of internally validated reports that become merged, tested and widely deployed fixes, including researcher and maintainer labor. Microsoft has not supplied that all-in conversion rate in the October 7 post.