Microsoft FORGE Lab: 140 Windows CVEs from AI-driven bug hunting

01What happened

Taesoo Kim, Microsoft's vice president of agentic security, published three lessons from the FORGE Lab's AI-driven vulnerability research on October 7, 2026. The post sets out what the lab produced on Windows and on open-source software from May to September 2026, with the counts and per-finding costs listed below. Cleared CVE identifiers go into a public index the lab keeps on GitHub.

02How it works

MDASH, Microsoft's multi-model agentic scanning harness, drives discovery, and the post says GPT-5.5 generated the proofs of concept it prices, without extensive tuning. An internal deduplication project built on abstract syntax trees removed about 45% of repeated findings across scans, by Microsoft's count. Validated findings then feed remediation and go back into discovery, so each stage leaves evidence the next one can reuse.

03Who is affected

Windows and 23 open-source projects, including the Linux kernel, are where the reports landed, and they went to MSRC and upstream maintainers through the usual channels. Nobody faces new exposure from the post itself: the AI here is the finder, not the target. Teams that run or buy AI-assisted vulnerability research are the audience for the throughput and cost figures.

04What to do

Judge an AI discovery pipeline end to end rather than by raw finding count, which is Microsoft's own argument: track duplicates, rejected reports, validated defects, queue age and the time from a confirmed defect to a released fix. Maintainers buried in machine-generated reports are the problem Akrites was set up to coordinate, and Microsoft says one of its Linux kernel reports became the first Akrites submission to reach a merged patch.

Sources 3 links, all fetched

1. 1microsoft.comMicrosoft Security Blog
2. 2github.comFORGE Lab CVE Index
3. 3akrites.orgAkrites