Microsoft's 100-Agent AI Harness Found 16 Windows CVEs — Including an Unauthenticated IKEv2 RCE
Sixteen of the vulnerabilities Microsoft patched in May’s Patch Tuesday were found not by human researchers but by MDASH — a multi-model agentic scanning harness built by Microsoft’s Autonomous Code Security team. Four of those sixteen are rated Critical, all of them reachable by unauthenticated remote attackers.
The system doesn’t run a single model. It orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models, each assigned a distinct role: auditor, debater, deduplicator, prover. A finding only advances if it survives adversarial cross-examination between agents. The architecture is designed to kill false positives before they reach engineers.
CyberGym: 88.45%, Five Points Ahead
On the public CyberGym benchmark — 1,507 real-world vulnerability reproduction tasks drawn from 188 OSS-Fuzz projects — MDASH scored 88.45%, the top position by roughly five points over the next competitor at 83.1%.
Microsoft also ran two retrospective precision tests on well-reviewed Windows components:
| Component | MSRC Cases (5 yr) | MDASH Recall |
|---|---|---|
| clfs.sys | 28 confirmed CVEs | 96% |
| tcpip.sys | 7 confirmed CVEs | 100% |
On an internal test driver seeded with 21 deliberately injected vulnerabilities — code not in any LLM training set — MDASH found all 21 with zero false positives.
The Two Bugs That Required Cross-File Reasoning
Two of the Critical findings illustrate why single-model approaches struggled where MDASH succeeded.
CVE-2026-33827 is a use-after-free in the Windows kernel TCP/IP stack triggered by specially crafted IPv4 packets carrying the SSRR routing option. The pointer release and its reuse are separated by multiple validation checks and alternate control flow branches across different functions. No single-function view connects them. MDASH caught the inconsistency by cross-referencing analogous patterns elsewhere in the codebase.
CVE-2026-33824 lives in ikeext.dll, the Windows IKEv2 service handling VPN keying for DirectAccess and Always-On VPN. A shallow memcpy during fragment reassembly leaves two owners holding the same heap pointer. Both eventually free it. The double-free spans six source files. Trigger: two UDP packets, no race condition, no authentication required. Because IKEEXT runs as LocalSystem, successful exploitation results in full system compromise. Microsoft scored it 9.8 CVSS.
CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon, allows unauthenticated remote code execution on any domain controller via a single crafted network request. Security researchers called it wormable. Also 9.8 CVSS.
Architecture Is the Moat
Microsoft’s VP of agentic security described the strategic design choice plainly: when a better model ships, swapping it in is a configuration change, not a rebuild. The pipeline is designed to outlast any individual model generation.
MDASH is now in limited private preview with a small number of customers, alongside existing internal deployment across Microsoft’s security engineering teams. The company said access will broaden as identity verification and misuse monitoring mature — the same framing Anthropic has used for Mythos.
The competitive framing matters: Anthropic’s Claude Mythos found 271 Firefox vulnerabilities. Google’s AI confirmed the first zero-day exploit in the wild. Microsoft’s MDASH found wormable domain controller bugs in its own kernel. AI-driven vulnerability discovery has now produced production-grade results at three of the four largest AI labs simultaneously.