Inside MDASH: How Microsoft Built an Army of 100+ AI Agents That Found 16 Critical Windows Vulnerabilities
Two weeks ago, Microsoft dropped something remarkable on Patch Tuesday. Sixteen new CVEs — four of them Critical remote code execution flaws in the Windows kernel TCP/IP stack, IKEv2 service, and DNS resolver — all discovered not by human security researchers, but by an AI system. Not just any AI system. A multi-model agentic scanning harness codenamed MDASH that orchestrates over 100 specialized AI agents working together like a coordinated team of elite vulnerability hunters.
This is the kind of story that makes me excited about the Microsoft ecosystem. It's not just a security win. It's a masterclass in how to build production-grade AI agent systems that deliver real, measurable value. And the architecture lessons here apply far beyond security — they're relevant to anyone building multi-agent AI systems today.
What MDASH Actually Does
At its core, MDASH is an agentic vulnerability discovery and remediation system. But "agentic" gets thrown around a lot these days, so let me be specific about what that means here.
MDASH takes a codebase — in this case, the Windows kernel networking stack, Hyper-V, and Azure components — and runs it through a structured five-stage pipeline. Each stage has its own specialized AI agents with distinct roles, tools, and stop criteria. The key insight: no single model does everything. The system is the product.
Here's the pipeline:
Prepare. The system ingests the target source code, builds language-aware indices, and maps the attack surface by analyzing commit history. It's not just dumping code into a prompt — it's building a structured understanding of the codebase.
Scan. Specialized auditor agents fan out over candidate code paths, each looking for specific classes of bugs. Use-after-free. Race conditions. Integer handling issues. IOCTL validation gaps. Locking errors. More than 100 agents work independently, each tuned with deep research from past CVEs and their patches.
Validate. A second cohort of agents — debaters — argue for and against each finding's reachability and exploitability. This is the part I love: disagreement between models is treated as signal. When an auditor flags something and the debater can't refute it, the finding's credibility goes up. It's an adversarial collaboration baked into the pipeline.
Dedup. Semantically equivalent findings get collapsed. If six agents found the same bug from different angles, it becomes one report.
Prove. Where the bug class allows, the system constructs and executes triggering inputs. For C/C++ code, this means actually running the vulnerable code path with AddressSanitizer to prove the bug exists.
The Numbers That Matter
Let's talk results, because they're genuinely impressive:
- •**21 of 21 planted vulnerabilities found** with zero false positives on a private test driver called StorageDrive — code that was never in any model's training data
- •**96% recall** against five years of confirmed MSRC cases in clfs.sys
- •**100% recall** in tcpip.sys — every single previously confirmed vulnerability was rediscovered
- •**88.45% score** on the public CyberGym benchmark of 1,507 real-world vulnerabilities — the top score on the leaderboard, roughly five points ahead of the next entry
- •**16 CVEs shipped** in the May 2026 Patch Tuesday, including four Critical RCEs
The StorageDrive result is particularly telling. It's a sample device driver used in Microsoft interviews for offensive security researchers, containing 21 deliberately injected vulnerabilities. Because it's private code never published anywhere, there's zero chance the models "learned the answers to the test." MDASH found all 21 with no false positives. That's professional-level security auditing, automated.
The Architecture Lesson: Ensemble Over Monolith
Here's what I think every developer building AI agent systems should take away from MDASH:
1. The model is one input. The system is the product.
MDASH runs a configurable panel of models — frontier models as heavy reasoners, distilled models as cost-effective debaters for high-volume passes, and a separate frontier model as an independent counterpoint. When a new model ships, A/B testing it against the current panel is one configuration change. The pipeline doesn't care which model is doing the work.
2. Specialization beats generalization.
An auditor agent does not reason like a debater agent, which does not reason like a prover agent. Each has its own prompt regime, its own tools, and its own stop criteria. Microsoft didn't try to build one prompt that does everything. They built over 100 specialized agents that each do one thing well.
3. Adversarial collaboration produces better results.
The debate stage is brilliant. Having agents argue for and against findings means the system catches its own mistakes. When two models disagree, that's not noise — it's a signal that deserves human attention. This is something you can apply to your own multi-agent systems today.
4. Domain plugins extend what foundation models can see.
Foundation models don't know kernel calling conventions, IRP rules, lock invariants, or IPC trust boundaries. MDASH has an extensible plugin system that lets domain experts inject that context. The CLFS proving plugin, for example, knows how to construct a triggering log file given a candidate finding. Your agents need the same kind of domain grounding.
5. Portability across model generations is a design goal, not an accident.
The pipeline's targeting, validation, dedup, and prove stages are model-agnostic by construction. When a new model lands, you flip a config and A/B test. The customer's prior investment — scope files, plugins, configurations, calibrations — all carry forward. This is how you build agent systems that get better every time a new model ships, without starting over.
Two Bugs That Show Why This Matters
The blog post from Microsoft's Autonomous Code Security team goes deep on two specific vulnerabilities, and they're worth understanding because they show what MDASH can do that a single-model approach can't.
CVE-2026-33827 is a remote unauthenticated use-after-free in tcpip.sys triggered by malformed IPv4 SSRR packets. Finding it required reasoning about object lifetime across non-trivial control flow and three independent concurrent free paths. This is the kind of bug that takes human researchers weeks of focused effort. MDASH found it automatically.
CVE-2026-33824 is an unauthenticated double-free in the IKEv2 service (ikeext.dll) that spans six source files and is only visible against the contrast of a correctly handled site elsewhere in the same codebase. Finding it requires understanding what "correct" looks like and spotting the deviation. That's exactly the kind of reasoning multi-model ensembles are good at.
What This Means for the Microsoft Ecosystem
MDASH is currently being used by Microsoft security engineering teams and tested by a small set of customers in private preview. But the implications go beyond security.
This is Microsoft demonstrating that multi-agent AI systems — not single models, not simple RAG pipelines, but coordinated ensembles of specialized agents — are ready for production at enterprise scale. The same architectural patterns that let MDASH find kernel vulnerabilities can be applied to code review, compliance auditing, test generation, and a hundred other developer productivity scenarios.
And it's built entirely within the Microsoft ecosystem. Azure infrastructure. Frontier models accessible through Azure AI. The same toolchain that any Microsoft shop can leverage today.
My Take
I've been writing about AI agents for months, and MDASH is the most compelling production deployment I've seen. Not because it's flashy — because it works. Because the architecture is sound. Because the results are measurable and meaningful.
If you're building multi-agent systems, study this architecture. The ensemble-over-monolith approach. The adversarial validation. The domain plugin pattern. The model-agnostic pipeline design. These aren't academic ideas — they're battle-tested patterns that found 16 real CVEs in the Windows kernel.
And if you're a Microsoft developer, take note: the same Azure AI services and tooling that power MDASH are available to you. The frontier is closer than you think.
Microsoft found 16 critical vulnerabilities in its own code using an army of AI agents. That's not just a security story. That's a glimpse of how all software will be built — and secured — going forward.