Microsoft's AI Bug Hunt Tripled CVEs: The Data Behind It

On 9 July 2026 Microsoft warned that AI-assisted vulnerability discovery would raise the volume of security updates, but gave no number. Five days later it shipped a July patch package containing 1150 CVEs.

Twelve months of data pulled from Microsoft's public CVRF API show the eight pre-ramp months averaged 383 CVEs, making July 2026 exactly 3.0 times that baseline. From April through July, Microsoft released 4159 CVEs, the equivalent of 10.9 months of output at the old rate compressed into four. Severity rose alongside volume rather than diluting it: the CVSS median climbed from 6.5 to 7.5, critical-rated flaws went from 26 to 66, and remote code execution issues roughly quadrupled from 42 to 165.

The driver is MDASH, Microsoft's multi-model agentic scanning harness, which re-found 96-100% of five years' worth of known vulnerabilities in core Windows components — evidence that the bugs were always discoverable and human review was simply the bottleneck. The same underlying technology explains why curl shut down its bug bounty after being flooded with worthless AI-generated reports; the difference is that Microsoft built a dedicated pipeline to validate candidates before a human sees them. The takeaway for engineers: vendor claims about security posture can now be checked directly against free, machine-readable public data — no privileged access required.