Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research

Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research - InfoQ

[BT](https://www.infoq.com/int/bt/ "bt")

InfoQ Software Architects' Newsletter

A monthly overview of things you need to know as an architect or aspiring architect.

View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

Close

Live Webinar and Q&A: Rethinking AppSec: Why Compiler‑Level Security Changes the Architecture Conversation (Jun 11, 2026)Save Your Seat

Close

Toggle Navigation

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

English edition

• English edition
• Chinese edition
• Japanese edition
• French edition

[Write for InfoQ](https://www.infoq.com/write-for-infoq/ "Write for InfoQ")

Search

RegisterSign in

Unlock the full InfoQ experience

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources.

Log In

or

Don't have an InfoQ account?

Register

• Stay updated on topics and peers that matter to youReceive instant alerts on the latest insights and trends.
• Quickly access free resources for continuous learningMinibooks, videos with transcripts, and training materials.
• Save articles and read at anytimeBookmark articles to read whenever youre ready.

Logo - Back to homepage

NewsArticlesPresentationsPodcastsGuides

Topics

[Development](https://www.infoq.com/development/ "Development")

• [Java](https://www.infoq.com/java/ "Java")
• [Kotlin](https://www.infoq.com/kotlin/ "Kotlin")
• [.Net](https://www.infoq.com/dotnet/ ".Net")
• [C#](https://www.infoq.com/c_sharp/ "C#")
• [Swift](https://www.infoq.com/swift/ "Swift")
• [Go](https://www.infoq.com/golang/ "Go")
• [Rust](https://www.infoq.com/rust/ "Rust")
• [JavaScript](https://www.infoq.com/javascript/ "JavaScript")

Featured in Development

• #### From VR to Flat Screens: Bridging the Input and Immersion Gap

Dany Lepage discusses the architectural journey of porting a hit VR title to seven non-VR platforms. He explains how his team solved the challenges of cross-progression, diverse input paradigms, and maintaining release velocity across Steam, iOS, and PlayStation. Beyond the tech, he shares candid lessons on the "product fit" gap when translating immersive social presence to 2D screens.


All in developmentFollow Topic

[Architecture & Design](https://www.infoq.com/architecture-design/ "Architecture & Design")

• [Architecture](https://www.infoq.com/architecture/ "Architecture")
• [Enterprise Architecture](https://www.infoq.com/enterprise-architecture/ "Enterprise Architecture")
• [Scalability/Performance](https://www.infoq.com/performance-scalability/ "Scalability/Performance")
• [Design](https://www.infoq.com/design/ "Design")
• [Case Studies](https://www.infoq.com/Case_Study/ "Case Studies")
• [Microservices](https://www.infoq.com/microservices/ "Microservices")
• [Service Mesh](https://www.infoq.com/servicemesh/ "Service Mesh")
• [Patterns](https://www.infoq.com/DesignPattern/ "Patterns")
• [Security](https://www.infoq.com/Security/ "Security")

Featured in Architecture & Design

• #### Context is the Key to the Agentic Architecture Revolution: a Conversation with Baruch Sadogursky

Michael Stiefel spoke to Baruch Sadogursky about software architecture in the age of agentic AI. LLM can function, albeit stochastically, as reasoning machines capable of interpreting human ambiguity. With the appropriate rigorous context artifacts to control the LLM’s reasoning, software specifications can become the source of truth, while the code becomes a disposable intermediate language.


All in architecture-designFollow Topic

[AI Infrastructure](https://www.infoq.com/ai-ml-data-eng/ "AI Infrastructure")

• [Big Data](https://www.infoq.com/bigdata/ "Big Data")
• [Machine Learning](https://www.infoq.com/machinelearning/ "Machine Learning")
• [NoSQL](https://www.infoq.com/nosql/ "NoSQL")
• [Database](https://www.infoq.com/database/ "Database")
• [Data Analytics](https://www.infoq.com/data-analytics/ "Data Analytics")
• [Streaming](https://www.infoq.com/streaming/ "Streaming")

Featured in AI, ML & Data Engineering

• #### AI Native Engineering

Ian Thomas shares a case study on embracing AI-native engineering within Meta’s Reality Labs. He explains the "Assess and Grow" framework, a maturity model designed to move teams from manual toil to AI-integrated innovation. He discusses real-world wins - including hitting 90% code coverage in record time - while addressing senior concerns like "code slop," review fatigue, and maintaining quality.


All in ai-ml-data-engFollow Topic

[Culture & Methods](https://www.infoq.com/culture-methods/ "Culture & Methods")

• [Agile](https://www.infoq.com/agile/ "Agile")
• [Diversity](https://www.infoq.com/diversity/ "Diversity")
• [Leadership](https://www.infoq.com/leadership/ "Leadership")
• [Lean/Kanban](https://www.infoq.com/lean/ "Lean/Kanban")
• [Personal Growth](https://www.infoq.com/personal-growth/ "Personal Growth")
• [Scrum](https://www.infoq.com/scrum/ "Scrum")
• [Sociocracy](https://www.infoq.com/sociocracy/ "Sociocracy")
• [Software Craftmanship](https://www.infoq.com/software_craftsmanship/ "Software Craftmanship")
• [Team Collaboration](https://www.infoq.com/team-collaboration/ "Team Collaboration")
• [Testing](https://www.infoq.com/testing/ "Testing")
• [UX](https://www.infoq.com/ux/ "UX")

Featured in Culture & Methods

• #### From Legacy to Sovereignty: Driving the Future of Insurance through Platform Engineering

Sergiu Petean discusses the strategic journey of evolving DevOps into platform engineering within heavily regulated enterprise environments. He explains how to maximize efficiency using dynamic reference architectures, align platform KPIs directly with board-level business goals, reduce cognitive load via custom team topologies, and maintain innovation sovereignty through open-source technology.


All in culture-methodsFollow Topic

DevOps

• [Infrastructure](https://www.infoq.com/infrastructure/ "Infrastructure")
• [Continuous Delivery](https://www.infoq.com/continuous_delivery/ "Continuous Delivery")
• [Automation](https://www.infoq.com/automation/ "Automation")
• [Containers](https://www.infoq.com/containers/ "Containers")
• [Cloud](https://www.infoq.com/cloud-computing/ "Cloud")
• [Observability](https://www.infoq.com/observability/ "Observability")

Featured in DevOps

• #### The Ironies of A^2 I^2

J. Paul Reed discusses the "ironies of automation" - a 40 years-old concept now amplified by AI. He explains how advanced systems often make the human operator more crucial, not less, while simultaneously degrading the skills needed to intervene. Sharing real-world stories of "AI-fueled" incidents, he shares why over-reliance on AI can double recovery times and how to maintain resilience.


All in devopsFollow Topic

[Events](https://events.infoq.com/ "Events")

Helpful links

• [About InfoQ](https://www.infoq.com/about-infoq "About InfoQ")
• [InfoQ Editors](https://www.infoq.com/infoq-editors "InfoQ Editors")
• [Write for InfoQ](https://www.infoq.com/write-for-infoq "Write for InfoQ")
• [About C4Media](https://c4media.com/ "About C4Media")
• [Diversity](https://c4media.com/diversity "Diversity")

Choose your language

• [En](https://www.infoq.com/news/2026/05/microsoft-mdash/# "InfoQ English")
• 中文
• 日本
• Fr


[InfoQ Homepage](https://www.infoq.com/ "InfoQ Homepage")[News](https://www.infoq.com/news "News")Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research

[AI, ML & Data Engineering](https://www.infoq.com/ai-ml-data-eng/ "AI, ML & Data Engineering")

Online InfoQ Architect Certification (June 10): Peer conversations that change how you think.

Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research

May 25, 2026 1 min read

by

• [](https://www.infoq.com/profile/Robert-Krzaczy%C5%84ski/)Robert Krzaczyński

Follow Senior Software Engineer

#### Write for InfoQ

Feed your curiosity.Help 550k+ global

senior developers

each month stay ahead.Get in touch

Log in to listen to this article

Loading audio

Audio 2

0:00 0:00

Normal 1.25x 1.5x

Like

• Reading list

Microsoft has introduced a new AI-driven vulnerability discovery system called MDASH, a multi-model agentic security platform designed to automate large-scale code auditing across Windows and other Microsoft software environments. The system combines more than 100 specialized AI agents that work together to scan, validate, debate, and prove vulnerabilities across complex codebases.

The announcement indicates a transition in AI-assisted cybersecurity from individual model testing to more integrated systems that focus on coordinated agents, validation processes, and automated proof generation. Microsoft emphasizes that the overall framework surrounding the models is more significant than any single model, particularly for extensive proprietary codebases like Windows, Hyper-V, and Azure.

According to Microsoft, MDASH achieved an 88.45% score on the public CyberGym benchmark of 1,507 real-world vulnerabilities, outperforming the next highest entry by roughly five points. Internally, the company reports 96% recall on historical clfs.sys vulnerabilities reviewed by the Microsoft Security Response Center, and 100% recall on historical tcpip.sys cases.

/filters:no_upscale()/news/2026/05/microsoft-mdash/en/resources/1Zrzut%20ekranu%202026-05-25%20o%2015.02.28-1779714730590.png)

_Source: Microsoft Blog_

Rather than relying on a single model or prompt chain, MDASH operates as a multi-stage pipeline. Specialized agents handle scanning, debate, validation, deduplication, and exploitation separately. Microsoft says this architecture helps the system reason across multiple files, identify lifecycle and concurrency bugs, and validate whether a vulnerability is practically exploitable instead of merely theoretical.

A major part of the announcement focused on the idea that future AI security tooling will depend less on raw model capability and more on orchestration systems built around models. Microsoft described MDASH as model-agnostic by design, allowing teams to swap or upgrade models while keeping the surrounding validation, proving, and workflow infrastructure intact.

The release also prompted discussion about the operational risks of large-scale agentic security systems. In a LinkedIn thread, Sandesh KS wrote:

The orchestration layer is exactly where it gets interesting — and dangerous. When specialized agents start coordinating across identity systems, financial monitoring, and cloud infrastructure simultaneously, the blast radius of a single misconfigured permission boundary becomes enormous. The governance layer has to be designed before the agents go live, not retrofitted after the first incident.

MDASH is currently being tested internally by Microsoft security teams and through a limited private preview with selected customers. The company says organizations interested in testing the system can apply through Microsoft Security’s preview program.

About the Author

[](https://www.infoq.com/profile/Robert-Krzaczy%C5%84ski/)

#### Robert Krzaczyński

Robert Krzaczyński is a software engineer with solid experience in developing web applications. Passionate about applying artificial intelligence algorithms in medicine and the broader healthcare sector, he continuously expands his expertise in ML and AI. He holds a BSc Eng degree in Control Engineering and Robotics, as well as an MSc Eng degree in Computer Science.

Show more Show less

#### This content is in the AI, ML & Data Engineering topic

Follow Topic

##### Related Topics:

• AI, ML & Data Engineering### AI, ML & Data Engineering

Followers: 5923

Follow Topic

• Large language models### Large language models

Followers: 141

Follow Topic

• Microsoft### Microsoft

Followers: 133

Follow Topic

* #### Popular in AI, ML & Data Engineering

• ##### OpenAI Open-Sources Symphony, a SPEC.md for Autonomous Coding Agent Orchestration

• ##### Designing a Multi-Agent System for Engineering Support at Scale: a Case Study from Grab

• ##### Anthropic's Code with Claude Announces Managed Agents, Proactive Workflows, Capability Curve

• ##### What I Learned Building Multi-Agent Systems from Scratch

• ##### Ubuntu Embraces Local AI instead of Cloud-First OS Integration

* #### Related Sponsors

• ##### Akka Launches Agentic Platform for Autonomous, Real-Time & Edge AI Systems

• ##### Durable Sessions for AI: Fixing the Hidden UX Failures in Production AI Apps (Live Webinar May 28, 2026) - Save Your Seat

• ##### Shipping Faster, Breaking More: Rethinking Delivery Systems in the Age of AI (Live Webinar May 28th) - Save Your Seat

• ##### [[Webinar] Creating Certainty in the Age of Agentic AI. Watch On-Demand.](https://www.infoq.com/vendorcontent/show.action?vcr=531d8edd-4f74-486b-aaca-10058c609c1c&primaryTopicId=4523&vcrPlace=BOTTOM&pageType=NEWS_PAGE&vcrReferrer=https%3A%2F%2Fwww.infoq.com%2Fnews%2F2026%2F05%2Fmicrosoft-mdash%2F)

• ##### The missing layer in the agentic AI stack: Why AI applications need durable sessions

• #### Related Sponsor

Drop in Ably AI Transport.

Purpose-built infrastructure for the entire agent-to-user experience. [Start building](https://www.infoq.com/url/f/a07f62d3-dae0-4726-a152-76804b3ba7e7/).

Related Content

• ##### Gemma 4 Multi-Token Prediction Delivers Up to ~3x Faster Token Generation

May 25, 2026

• ##### xAI Releases Grok Skills and Updates Tool Calling Responses API

May 22, 2026

• ##### Six Sessions at QCon AI Boston 2026 That Take Productionizing AI Seriously

May 21, 2026

• ##### With Android CLI, Google is Making the Android Toolchain Agent-Friendly

May 21, 2026

• ##### OpenAI Open-Sources Symphony, a SPEC.md for Autonomous Coding Agent Orchestration

May 17, 2026

• ##### Ubuntu Embraces Local AI instead of Cloud-First OS Integration

May 16, 2026

• ##### Anthropic Introduces Routines for Claude Code Automation

May 15, 2026

• ##### Anthropic Traces Six Weeks of Claude Code Quality Complaints to Three Overlapping Product Changes

May 14, 2026

• ##### Anthropic Launches Claude Platform on AWS

May 13, 2026

Related Sponsors

• #### Does your AI stack need a session layer? A maturity framework for teams building AI agents

Explore the missing “session layer” in the AI stack—where many production failures originate. This framework outlines maturity stages for delivering continuous, stateful AI experiences, from fragile HTTP streaming to resilient, multi-device, real-time systems with durable sessions. Read Now.

• Sponsored by


Related Content

• ##### Coder Agents Enable Running AI Coding Workflows on Self-Hosted Infrastructure

May 11, 2026

• ##### OpenAI Introduces Websocket-Based Execution Mode to Reduce Latency in Agentic Workflows

May 07, 2026

• ##### Google New TPU Generation is Specifically Designed for Agents and SOTA Model Training

May 06, 2026

• ##### Mistral Adds Remote Agents and Work Mode to Le Chat

May 05, 2026

• ##### Cloudflare Builds High-Performance Infrastructure for Running LLMs

May 03, 2026

• ##### NVIDIA Launches Ising Open Models for Quantum Computing

Apr 30, 2026

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

• Development

• ##### [Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks](https://www.infoq.com/news/2026/05/pip-261-dependency-cooldowns/ "Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks")

• ##### [Cloudflare and Stripe Let AI Agents Create Accounts, Buy Domains, and Deploy to Production](https://www.infoq.com/news/2026/05/cloudflare-stripe-agent-commerce/ "Cloudflare and Stripe Let AI Agents Create Accounts, Buy Domains, and Deploy to Production")

• ##### [Google Introduces Cloud Fraud Defense as Successor to reCAPTCHA](https://www.infoq.com/news/2026/05/cloud-fraud-defense-recaptcha/ "Google Introduces Cloud Fraud Defense as Successor to reCAPTCHA")

• Architecture & Design

• ##### [Uber Improves Restaurant Recommendations Using Real-Time Signals and Listwise Ranking](https://www.infoq.com/news/2026/05/uber-eats-ranking-system/ "Uber Improves Restaurant Recommendations Using Real-Time Signals and Listwise Ranking")

• ##### [Designing a Multi-Agent System for Engineering Support at Scale: a Case Study from Grab](https://www.infoq.com/news/2026/05/grab-multi-agent-support-system/ "Designing a Multi-Agent System for Engineering Support at Scale: a Case Study from Grab")

• ##### [OpenAI Outlines WebRTC Architecture for Low-Latency Voice AI at Scale](https://www.infoq.com/news/2026/05/openai-voice-ai-scale/ "OpenAI Outlines WebRTC Architecture for Low-Latency Voice AI at Scale")

• Culture & Methods

• ##### [From Legacy to Sovereignty: Driving the Future of Insurance through Platform Engineering](https://www.infoq.com/presentations/insurance-platform-engineering/ "From Legacy to Sovereignty: Driving the Future of Insurance through Platform Engineering")

• ##### [How Platform Engineering Using Golden Bricks Can Enable Fast and Smooth Delivery](https://www.infoq.com/news/2026/05/platform-golden-bricks/ "How Platform Engineering Using Golden Bricks Can Enable Fast and Smooth Delivery")

• ##### [Product Thinking for Cloud Native Engineers](https://www.infoq.com/presentations/product-cloud-native/ "Product Thinking for Cloud Native Engineers")

• AI, ML & Data Engineering

• ##### [Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research](https://www.infoq.com/news/2026/05/microsoft-mdash/ "Microsoft Introduces MDASH for Large-Scale AI Vulnerability Research")

• ##### [Gemma 4 Multi-Token Prediction Delivers Up to ~3x Faster Token Generation](https://www.infoq.com/news/2026/05/gemma4-multi-token-prediction/ "Gemma 4 Multi-Token Prediction Delivers Up to ~3x Faster Token Generation")

• ##### [Google Introduces Middleware Architecture for Genkit Applications](https://www.infoq.com/news/2026/05/google-genkit-middleware/ "Google Introduces Middleware Architecture for Genkit Applications")

• DevOps

• ##### [Discord Rebuilds Database Operations Around Automation to Manage ScyllaDB at Massive Scale](https://www.infoq.com/news/2026/05/discord-scylladb-automation/ "Discord Rebuilds Database Operations Around Automation to Manage ScyllaDB at Massive Scale")

• ##### [The Ironies of A^2 I^2](https://www.infoq.com/presentations/automation-incidents-ai/ "The Ironies of A^2 I^2")

• ##### [OpenTofu 1.12: the Feature Terraform Never Shipped](https://www.infoq.com/news/2026/05/opentofu-release-terraform/ "OpenTofu 1.12: the Feature Terraform Never Shipped")

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

• Get a quick overview of content published on a variety of innovator and early adopter technologies
• Learn what you don’t know that you don’t know
• Stay up to date with the latest information from the topics you are interested in

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

**ONLINE INFOQ CERTIFICATION PROGRAM** A Cohort for Senior Engineers and Architects * **Focused on ARCHITECTURE** with Luca Mezzalira | JUNE 10 * **Focused on AI ENGINEERING** with Hien Luu | JULY 25 Bring a real architecture or AI engineering challenge from your work. Spend 5 weeks pressure-testing your approach with senior peers from other companies and experienced facilitators. Explore the upcoming cohorts. **Register Now.**

#### Events

• ##### QCon AI Boston

June 1-2, 2026

• ##### Online InfoQ Architect Certification

June 10, 2026

• ##### Online InfoQ AI Engineering Certification

July 25, 2026

• ##### QCon San Francisco

November 16-20, 2026

#### Follow us on

Youtube 232K FollowersLinkedin 26K FollowersInstagram NewRSS 19K ReadersX 57.1k FollowersFacebook 21K LikesBluesky New

#### Stay in the know

The InfoQ PodcastEngineering Culture PodcastThe Software Architects' Newsletter

General Feedback [[email protected]](mailto:[email protected]) Advertising [[email protected]](mailto:[email protected]) Editorial [[email protected]](mailto:[email protected]) Marketing [[email protected]](mailto:[email protected])

InfoQ.com and all content copyright © 2006-2026 C4Media Inc.

Privacy Notice, Terms And Conditions, Cookie Policy

Close

[BT](https://www.infoq.com/int/bt/ "bt")