Loading story…
Microsoft is contending with a sharp rise in software vulnerabilities uncovered by Anthropic’s AI model Mythos under Project Glasswing, according to internal materials reviewed by ProPublica. The report says the model was identifying flaws faster than Microsoft could remediate them, including 90 critical and 141 important SharePoint bugs found in April alone, with additional issues discovered in early May. Microsoft reportedly prioritized critical and important findings, while security experts warned that lower-severity flaws can still be chained into serious attack paths, reducing the usefulness of traditional severity-based triage.
The pressure from AI-assisted bug discovery is reflected in Microsoft’s unusually heavy June security updates, which included dozens of fixes across Windows, Microsoft 365, Azure, Office, Exchange, SharePoint, and developer tools. Among the most urgent issues was CVE-2026-41091, a Microsoft Defender elevation-of-privilege flaw that was publicly disclosed and exploited in the wild, alongside multiple critical remote-code-execution vulnerabilities such as CVE-2026-48567 in Azure HorizonDB and CVE-2026-47291 in HTTP.sys. The disclosures highlight growing concern that defenders may have only a limited lead before attackers gain comparable AI-driven vulnerability discovery capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On July 29, 2026, ProPublica reported that Microsoft's internal response to vulnerabilities found by Anthropic's Mythos was being strained by the pace of discovery. The article framed the issue as a broader warning that defenders may have only a limited window before attackers gain similar AI-assisted vulnerability discovery capabilities.
On June 9, 2026, ZDI reviewed Microsoft's June 2026 security updates, highlighting CVE-2026-41091 in Microsoft Defender as publicly disclosed and exploited in the wild. The patch cycle also included numerous critical flaws across Azure, Windows, Office, Exchange, SharePoint, and other components.
In mid-May 2026, Microsoft held an internal meeting on Project Glasswing where managers said Anthropic's Mythos was finding vulnerabilities faster than Microsoft could patch them. Engineers were told they had roughly two weeks to reduce April bug counts before May 31 amid concern that public or adversary capabilities could catch up after June 1.
ProPublica reports that internal Microsoft materials showed more vulnerabilities were discovered in early May after the large April SharePoint haul. This indicated the AI-assisted discovery surge was continuing rather than tapering off.
According to internal Microsoft materials cited by ProPublica, Anthropic's Mythos model identified 90 critical and 141 important SharePoint vulnerabilities in April alone. The volume of findings reportedly outpaced Microsoft's ability to patch them.
As the volume of AI-discovered vulnerabilities grew, Microsoft reportedly prioritized remediation of critical and important bugs first. Experts cited by ProPublica warned that this severity-based triage could miss dangerous exploit chains built from lower-severity issues.
Anthropic says it launched Project Glasswing with Microsoft to use AI systems to help identify and secure critical software vulnerabilities. The reference does not provide a specific event date for the launch beyond the existence of the project.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
techdirt.com
Open sourcepropublica.org
Open sourcezerodayinitiative.com
Open sourcemicrosoft.com
Open sourceanthropic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft warned customers to expect a sustained rise in Windows security updates as it expands AI-assisted vulnerability discovery, then followed with unusually large Patch Tuesday releases that underscored the shift. The company said its multi-model agentic scanning harness, **MDASH**, is finding more flaws across the Windows codebase and is being paired with updates to Microsoft’s Secure Development Lifecycle to address AI-enabled attack paths while keeping human validation in the loop. External reporting and national CERT coverage highlighted the broader operational impact for defenders as vulnerability volume increases. The most dramatic release fixed **570 CVEs** in a record Patch Tuesday, including three zero-days and two that were exploited in the wild: `CVE-2026-56155` in **Active Directory Federation Services** and `CVE-2026-56164` in **Microsoft SharePoint Server**. Microsoft also patched the publicly disclosed `CVE-2026-50661` **BitLocker** security feature bypass, while the prior month’s update addressed **200 CVEs**, including the `CVE-2026-49160` **"HTTP/2 Bomb"** denial-of-service flaw, `CVE-2026-50507` in BitLocker, and `CVE-2026-45586`, a Windows elevation-of-privilege bug that could grant **SYSTEM** access. Security observers said the spike reflects AI-driven fuzzing, variant hunting, and large-scale static analysis, increasing pressure on organizations to prioritize asset inventory and risk-based patching.
Aug 17, 2026
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026
Microsoft released its largest Patch Tuesday update on record, fixing roughly **570 to 622 Microsoft CVEs** across Windows, Office, SharePoint Server, Exchange Server, SQL Server, Edge, Azure, Defender, and developer tools. The release included **three zero-days**, with **CVE-2026-56155** in **Active Directory Federation Services (AD FS)** and **CVE-2026-56164** in **on-premises Microsoft SharePoint Server** confirmed as exploited in the wild, while **CVE-2026-50661** patched a publicly disclosed **BitLocker** security feature bypass requiring physical access. Microsoft and multiple security outlets said the surge in findings was partly driven by AI-assisted vulnerability discovery, while the broader update also addressed dozens of critical remote code execution flaws in services such as DHCP, Hyper-V, Office, Exchange, SQL Server, Copilot, and SharePoint. U.S. agencies and industry groups elevated the urgency around SharePoint after CISA warned that attackers were actively exploiting **CVE-2026-56164** alongside **CVE-2026-32201** and **CVE-2026-45659** against internet-exposed on-premises servers, enabling unauthorized access, remote code execution, theft of IIS machine keys, persistence, and malware deployment. CISA added the exploited AD FS and SharePoint flaws to its **Known Exploited Vulnerabilities** catalog and urged immediate remediation, while Microsoft recommended SharePoint hardening measures including **AMSI integration with full request body scanning** and stronger Defender protections; exposed identity systems, SharePoint farms, and other internet-facing Microsoft services were identified as the highest-priority patch targets.
Jul 24, 2026