MDASH Simply · 5 of 5
What MDASH Found — and What It Means for You
Microsoft says MDASH found 16 Windows security bugs; here is what that proves, what it does not, and how people should use it.
Imagine a careful inspector walking through a huge building, looking behind walls and under floors for hidden cracks before anyone gets hurt. MDASH is the name Microsoft uses for an artificial intelligence (AI) security tool, meaning software that uses computer-based reasoning to help find problems. Microsoft says MDASH helped find serious hidden weaknesses in Windows, and the important lesson is simple: AI can now help people look for some very hard security bugs, but people still make the decisions and own the fixes.
The headline result
Think of a locked office building. The doors, badges, wiring, and control room all need to work safely. In a computer, similar hidden parts handle who can connect, who can sign in, and what the machine is allowed to do.
On May 12, 2026, Microsoft said MDASH helped its researchers find 16 new vulnerabilities in Microsoft Windows. A vulnerability is a weak spot that could let someone do something they should not be able to do. Microsoft Windows is an operating system, which means the main software that runs a computer and lets other programs use the computer.
These 16 vulnerabilities were in the parts of Windows that handle networking and signing in. Networking means computers talking to each other. Signing in means proving who you are before the computer lets you in.
Four of the 16 were rated Critical remote code execution (RCE). Remote code execution means an attacker far away could make the computer run the attacker's own instructions. Critical means the most serious rating Microsoft uses for this kind of security problem.
Microsoft said all 16 were fixed and sent to users in that month's Patch Tuesday update. A patch is a repair for software, and Patch Tuesday is Microsoft's regular monthly day for sending many security repairs. Each weakness also received its own Common Vulnerabilities and Exposures (CVE) identifier, which is a public tracking label for a known security problem.
Why the deep layer matters
Picture a building's control room. If a light bulb fails in one office, that is annoying. If the control room fails, the whole building can be affected. Computers have a similar control room.
That control room is called the kernel, which is the most trusted core of an operating system. Some of the vulnerabilities Microsoft reported were in Windows kernel networking code, meaning the deep Windows code that helps the computer communicate with other computers.
Microsoft said 10 of the 16 vulnerabilities were in kernel mode. Kernel mode is the computer's highest-trust working area, where code can control very important parts of the machine. The other 6 were in user mode. User mode is the normal working area where everyday apps run, with less power than the kernel.
This split matters because a bug in a high-trust area can be more dangerous. It can also be harder to find, because the code is complex and connected to many other parts.
The public test result
A school exam is not the same as real life, but a hard, fair exam can still tell you something useful. Security tools also have tests like that.
Microsoft points to a public benchmark called CyberGym. A benchmark is a shared test used to compare tools in a consistent way. CyberGym contains 1,507 real-world bug-finding tasks from 188 open-source software projects. Open-source software is software whose code can be read and studied by the public.
On the published CyberGym leaderboard at the time, MDASH reached the top score, about 88 percent. A leaderboard is a public ranking of scores. Microsoft said this was several points ahead of the next entry.
Microsoft also said MDASH reached that result using generally available AI models. An AI model is the part of an AI system that has learned patterns from data and uses them to produce answers. Generally available means the models were not described as rare private research tools.
What MDASH does not do
A smoke alarm can warn you about danger, but it does not rebuild the house. MDASH is closer to the smoke alarm than the builder.
Microsoft describes MDASH as read-only. Read-only means it can look at code and explain possible problems, but it does not change systems by itself. People still decide what to do with the findings.
There is a separate optional step where a developer can ask another tool to draft a possible fix on a fresh copy of the code. A developer is a person who writes or changes software. A draft fix is only a suggested repair. A human reviews it, approves it, and applies it if it is right. Nothing ships automatically.
MDASH works on source code. Source code is the human-readable instructions developers write before software is packaged into a finished program. It is not described here as a tool that scans only finished, packaged programs.
- It finds and explains possible security bugs.
- It does not repair your systems on its own.
- It does not replace a human developer's review.
- It is aimed at source code, not only finished programs.
Why AI teamwork changes the search
Imagine several careful reviewers reading the same long contract. One spots a strange sentence, another checks whether it truly matters, and a third explains the risk in plain language. That is the basic idea behind a team-style AI search.
The deeper security bugs are often not sitting in one obvious line. They can be hidden across many steps in the code. One part accepts information, another part changes it, and a later part trusts it too much. A person can find these paths, but it takes rare skill and a lot of time.
Microsoft's point is that a well-organized group of AI helpers can search, challenge, and explain findings at a scale people could not manage alone. This does not make the AI an oracle. An oracle is a source people treat as always right. MDASH is not that. Its findings still need human review.
Because AI answers can vary between runs and can take time, MDASH is a better fit for careful, in-depth review than for an instant yes-or-no gate. A gate is a checkpoint that automatically blocks or allows a change.
What this means for real decisions
If you lead a team, buy software, or help keep systems safe, the useful question is not, "Can AI replace the security team?" The better question is, "Where can this kind of helper make careful people more effective?"
A leader is someone responsible for priorities, budget, or risk. A practitioner is someone doing the hands-on work, such as writing code, testing it, or reviewing security. For both groups, MDASH points to a practical pattern: use AI for deep searching, but keep humans in charge of judgment, repair, and release.
That affects planning. Teams may need time to review AI findings instead of treating them as automatic truth. They may need a clear process for deciding which findings matter most. They may also need to keep using ordinary security checks, because MDASH is described as an added layer, not a replacement.
The safest mindset is balanced. Do not ignore the evidence, because Microsoft reported real fixed vulnerabilities and a strong public test result. Do not overstate it either, because the tool is read-only, source-code-focused, and not instant or automatic.
- Use it for deep review where hidden bugs are hard to trace by hand.
- Do not use it as the only pass-or-fail security checkpoint.
- Plan human time for triage, which means sorting findings by importance.
- Keep existing tests, code review, and patching routines in place.
The plain-language takeaway
For most of computing history, the hardest security bugs were like cracks hidden inside a wall. Only a small number of experts could trace them, and even then it took patience and luck.
MDASH shows a change in what is possible. AI can now help search through complicated source code, connect clues, and explain possible danger. Microsoft says that help led to 16 Windows fixes in one Patch Tuesday release, including 4 Critical remote code execution issues.
The meaning is encouraging but not magical. Software may get safer when defenders find and fix deep bugs before attackers find them. But the machine is still an assistant. It does the tiring search work. People decide what is real, what matters, and what repair should ship.
If you remember one idea, remember this: AI can now help hunt some of the hardest security bugs at a scale people could not reach alone, while human judgment must remain in the driver's seat.
Key takeaways
- Microsoft said MDASH helped find 16 Windows vulnerabilities announced on May 12, 2026.
- Four of those were Critical remote code execution issues, the most serious category described here.
- All 16 were fixed in that month's Patch Tuesday update and tracked with CVE identifiers.
- MDASH also scored about 88 percent on the public CyberGym benchmark, leading the published leaderboard at the time.
- MDASH is read-only and source-code-focused; it does not fix systems or ship changes by itself.
- The best use is as a deep security assistant, with humans still reviewing, deciding, and applying fixes.
Glossary
- Artificial intelligence (AI)
- Software that uses computer-based reasoning to find patterns, produce answers, or help with tasks.
- Vulnerability
- A weak spot in software that could let someone do something they should not be able to do.
- Remote code execution (RCE)
- A security problem where an attacker far away can make a computer run the attacker's own instructions.
- Kernel
- The most trusted core of an operating system, where the computer's most important controls live.
- User mode
- The normal working area where everyday apps run with limited power.
- Common Vulnerabilities and Exposures (CVE) identifier
- A public tracking label for a known security problem.
- Benchmark
- A shared test used to compare tools in a consistent way.
- Source code
- The human-readable instructions developers write before software becomes a finished program.
Sources
This article is based only on public, authoritative Microsoft documentation.