Microsoft: Three lessons from frontier AI vulnerability research

Evidence record

FORGE Lab distinguishes validated reports from fixes and reports Windows CVE cohorts, acknowledged open-source reports and precisely bounded automated PoC validation costs.

Read the original source ↗

Claim-level citations (4)

• supportsMicrosoft FORGE reported AI-assisted vulnerability discovery with validation bottlenecks: Microsoft FORGE reports 140 assigned Windows CVEs from May to September 2026, together with 155 internally validated open-source vulnerability reports across 23 projects.

  Introduction and Open-source vulnerability reporting snapshot.

• supportsMicrosoft FORGE reported AI-assisted vulnerability discovery with validation bottlenecks: The team reports an average of $3.61 model cost and 21.5 minutes for proof-of-crash generation on 182 successful examples, explicitly excluding initial scouting, filtered cases, human review and patch preparation.

  Measured costs of automated validation.

• supportsMicrosoft FORGE reported AI-assisted vulnerability discovery with validation bottlenecks: Of Microsoft's 155 internally validated open-source reports across 23 projects, 93 across 14 projects or project families had documented maintainer acknowledgement or acceptance at publication. The 39 hackathon reports were included in the 155, not an additional total.

  Open-source vulnerability reporting snapshot; FORGE OSS Bug Hunt Party.

• supportsMicrosoft FORGE reported AI-assisted vulnerability discovery with validation bottlenecks: Microsoft says the quoted $3.61 and 21.5-minute averages cover all attempts associated with 182 successful crash cases using GPT-5.5, while excluding initial screening, failed or filtered candidates, human investigation and patch preparation.

  Measured costs of automated validation, paragraphs 1-3.