Microsoft Faces Surge of AI-Discovered Vulnerabilities in SharePoint and Core Products

Microsoft is contending with a sharp rise in software vulnerabilities uncovered by Anthropic’s AI model Mythos under Project Glasswing, according to internal materials reviewed by ProPublica. The report says the model was identifying flaws faster than Microsoft could remediate them, including 90 critical and 141 important SharePoint bugs found in April alone, with additional issues discovered in early May. Microsoft reportedly prioritized critical and important findings, while security experts warned that lower-severity flaws can still be chained into serious attack paths, reducing the usefulness of traditional severity-based triage.

The pressure from AI-assisted bug discovery is reflected in Microsoft’s unusually heavy June security updates, which included dozens of fixes across Windows, Microsoft 365, Azure, Office, Exchange, SharePoint, and developer tools. Among the most urgent issues was CVE-2026-41091, a Microsoft Defender elevation-of-privilege flaw that was publicly disclosed and exploited in the wild, alongside multiple critical remote-code-execution vulnerabilities such as CVE-2026-48567 in Azure HorizonDB and CVE-2026-47291 in HTTP.sys. The disclosures highlight growing concern that defenders may have only a limited lead before attackers gain comparable AI-driven vulnerability discovery capabilities.