Microsoft sends more than 100 AI agents into Windows code forensics

Microsoft has introduced MDASH, a new agentic vulnerability discovery system aimed at a problem that another security chatbot will not solve: how to find flaws across enormous codebases, verify them, and separate real security risk from noise. According to InfoQ, MDASH is a multi-model security platform built to automate large-scale code auditing across Windows and other Microsoft software environments.

The important detail is the architecture. The system combines more than 100 specialized AI agents. They are not merely running parallel text searches; they appear to occupy different roles in the research chain. Some scan complex code areas, some validate findings, others challenge conclusions, and part of the system attempts to prove that a vulnerability is real. That makes MDASH closer to an automated security lab than to a conventional static analysis tool.

For Microsoft, that direction is unsurprising. The attack surface spans Windows, internal components, and wider software environments. Manual review remains essential, but it does not scale cleanly when code, dependencies, and integrations keep expanding. MDASH tries to absorb part of the slow research workload: detect a suspicious pattern, connect it to a possible exploit path, and then force another model or agent to challenge the claim.

The key word is “prove.” Security teams do not need an infinite list of possible problems; they need findings that can survive review. If an agentic system only produces alerts, it increases the cost of triage. If it can organize debate between models, filter weak hypotheses, and surface vulnerabilities with a credible evidence trail, then it changes the economics of vulnerability research. That does not remove human researchers from the process, but it moves them toward supervision, prioritization, and confirmation of the most important cases.

MDASH fits into Microsoft’s broader security posture, including public-facing programs such as the Microsoft Security Response Center and secure engineering practices described through the Microsoft Security Development Lifecycle. The difference is that an agentic platform is not just a documentation or assistant layer. It is an operational research mechanism. In a large organization, that could mean finding weaknesses earlier, before they become public product defects or more expensive incidents.

The limits still matter. The available description does not show that MDASH replaces security teams, nor that every finding automatically becomes a confirmed patch. Its value will depend on how well it reduces false positives, how deeply it covers genuinely critical code paths, and whether its vulnerability proofs can be reproduced. But the direction is clear. AI in security is no longer only helping write reports; it is moving into the forensic work of code itself.