3 lessons from frontier AI vulnerability research

Microsoft Security’s FORGE Lab describes its AI-native vulnerability research program (MDASH) and operational results from May–September 2026: 140 Windows CVEs assigned, 155 internally validated reports across 23 open-source projects (with 93 acknowledged/accepted by maintainers), and metrics on automated validation (PoC and privilege escalation testing). The post focuses on lessons for scaling discovery into validated fixes—automation for reproducible triggers, routing reasoning work, integrating with CI/CD and maintainers, and coordinating disclosures (including contributions to the Linux kernel via Akrites).