This month Microsoft announced something I think we will remember. A new AI system, codename MDASH, helped its researchers find 16 new vulnerabilities in the Windows networking and authentication stack, four of them critical remote code execution flaws. They were fixed in this month\u00b4s Patch Tuesday.<\/p>\n
MDASH, the multi-model agentic scanning harness, isn\u00b4t a single model. It orchestrates more than a hundred specialised AI agents across a set of different models. Some agents propose candidate bugs, others try to disprove them, others build a proof that the bug can actually be triggered. Only findings that survive the whole process are reported. That is a big reason why the results are reported as precise, without the flood of false positives that has made automated scanning so tiresome for developers.<\/p>\n
The code it found bugs in isn\u00b4t easy. Kernel networking and authentication components, where human experts have looked for years.<\/p>\n
What does this mean for you? First, patch this month\u00b4s updates quickly. Critical remote code execution in networking components is exactly the kind of thing attackers love.<\/p>\n
Second, expect more of this. The same approach will be pointed at more and more code, by Microsoft and by others. The patch volume will grow, as I wrote last month.<\/p>\n
Third, remember that attackers will get similar tools. Some already have.<\/p>\n
The interesting part isn\u00b4t the model. It is the system around it.<\/p>\n
Welcome to the age of machine found bugs.<\/p>\n","protected":false},"excerpt":{"rendered":"
This month Microsoft announced something I think we will remember. A new AI system, codename MDASH, helped its researchers find 16 new vulnerabilities in the Windows networking and authentication stack, four of them critical remote code execution flaws. They were fixed in this month\u00b4s Patch Tuesday. MDASH, the multi-model agentic scanning harness, isn\u00b4t a single […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[197,198,195],"class_list":["post-1531","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-mdash","tag-patch-tuesday","tag-vulnerabilities"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1531"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1531\/revisions"}],"predecessor-version":[{"id":1564,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1531\/revisions\/1564"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}