For most businesses, software security works on a slow rhythm. A monthly update arrives, IT applies it over a few weeks, and life continues. That rhythm is about to change, and the reason is a system called MDASH that Microsoft revealed this week.
MDASH uses more than 100 specialised AI agents working in sequence. Some scan code for potential weaknesses. A second group debates whether each finding is genuine and actually exploitable. A final stage builds test attacks to confirm the flaw is real. On its first live run, the system found 16 previously unknown security holes in Windows networking and authentication software, including four that could let an unauthenticated attacker run code on a machine remotely. Ten of those 16 flaws sit in what is called kernel-mode, meaning the deepest, most privileged layer of an operating system.
The debate architecture matters. When the scanning agents flag something and the debating agents cannot disprove it, the finding gains credibility. Microsoft says this is how MDASH catches bugs that span six or more source files, the kind a single model reviewing one file at a time would miss entirely.
The benchmark comparison with Anthropicʼs Mythos model tells a broader story. Mythos, launched in April 2026 with enough alarm to trigger US Congressional briefings and a UK government assessment, is a single powerful AI model wrapped in an agent framework. MDASH beat it on the main public benchmark by roughly five percentage points by using coordination instead of raw power. Independent researchers confirmed this pattern weeks before MDASH was even announced, showing that smaller, cheaper models working in a structured pipeline could reproduce most of Mythosʼs headline results. The conclusion from multiple corners of the industry is the same: the system architecture matters more than the individual AI model inside it.
The practical consequence for any business that runs software, or that depends on software vendors, is a faster patch cycle. Microsoft has already fixed more than 500 vulnerabilities in the first five months of 2026, on pace to exceed its annual record set in 2020. Microsoft told customers directly to expect this trend to continue. Oracle announced it is switching from quarterly to monthly security patches. Google shipped 127 Chrome fixes in a single day alongside Microsoft's latest release. The UK National Cyber Security Centre warned organisations to prepare for a surge in urgent software updates.
There is an uncomfortable side to this. AI finds the bugs. But applying the fixes still requires human IT teams to test, schedule, and deploy updates across potentially thousands of machines. If discovery accelerates but patching capacity stays flat, the window between a flaw being found and being closed stays dangerously wide. HackerOne, which runs the largest bug-reporting marketplace for open-source software, already paused its programme this year, citing a growing imbalance between the volume of newly discovered flaws and the ability of developers to fix them.
The same capabilities that help defenders also help attackers. Google's threat intelligence team separately reported this week what it described as the first known case of a threat actor using an AI-developed exploit in a planned mass attack. The attack was disrupted before it launched, but the precedent exists.
For any organisation that manages IT infrastructure, the immediate signal is clear. Patching practices built for a world of 50 to 100 security updates a month need to be reviewed. The volume is going up, it will not come back down, and the flaws being found now are serious ones that have been hiding in widely-used software for years.