{"id":1618,"date":"2026-07-29T18:22:56","date_gmt":"2026-07-29T18:22:56","guid":{"rendered":"https:\/\/valutednews.com\/?p=1618"},"modified":"2026-07-29T18:22:56","modified_gmt":"2026-07-29T18:22:56","slug":"microsoft-struggling-with-hundreds-of-ai-discovered-security-bugs-propublica","status":"publish","type":"post","link":"https:\/\/valutednews.com\/?p=1618","title":{"rendered":"Microsoft Struggling With Hundreds of AI-Discovered Security Bugs \u2014 ProPublica"},"content":{"rendered":"
\"Microsoft<\/div>

<\/p>\n

\n

On an afternoon in mid-May, dozens of Microsoft engineers and their managers gathered online and in a conference room at the company\u2019s Redmond, Washington, headquarters to discuss Project Glasswing.<\/p>\n

The tech giant was racing to fix weaknesses in its code that a new AI model known as Mythos was uncovering at an unprecedented clip. The AI behemoth Anthropic, which developed Mythos, had given access to select organizations that make software used by regular people, companies and governments across the world. The goal was to find and fix the vulnerabilities before hackers and adversarial governments like China began using similar tools to find and exploit them for espionage and sabotage.<\/p>\n

As the group settled in, one engineer asked the question that loomed over the meeting: Did Mythos \u201clive up to the hype that Anthropic claimed it would have had?\u201d<\/p>\n

\u201cYes,\u201d a manager responded, according to a recording of the meeting viewed by ProPublica.<\/p>\n

The version being used by Microsoft, Claude Mythos Preview, was surfacing bugs faster than the tech giant could patch them, and engineers, the manager said, were now in \u201ca mad dash\u201d to close the gap.<\/p>\n

One slide in that day\u2019s presentation showed that in April alone, Mythos had uncovered 90 \u201ccritical\u201d bugs and 141 \u201cimportant\u201d ones in SharePoint, Microsoft\u2019s widely used collaboration software. In the first half of May it found even more.<\/p>\n

\u201cPlease, please, please if your org has any April bugs, drive those down,\u201d engineering manager Hans Andersen implored the group. They had roughly two weeks \u201cto find as many things and do as much good as we can with this access.\u201d<\/p>\n

May 31, he explained, \u201cis considered the day when the rest of the world will have caught up.\u201d<\/p>\n

The engineers on the call poked at that assertion, with one of them summing up the predicament: \u201cSo basically you\u2019re saying if it\u2019s released on June 1, then on June 2 the adversaries will have our bugs?\u201d<\/p>\n

Yep, one person responded. Yep, another echoed.<\/p>\n

Ever since Anthropic kick-started a national conversation about the bug-hunting power of AI in April, when Project Glasswing was made public<\/a>, national security experts predicted that the U.S. would have a window of opportunity to fix flaws before adversaries would have similar models capable of discovering the same weaknesses. In late June, the international alliance of intelligence agencies known as the Five Eyes \u2014 whose members are the U.S., Australia, Canada, New Zealand and the U.K. \u2014 warned in an unusual joint statement<\/a> that in a matter of months, that window would be closing. But the recording of the Microsoft meeting, along with internal documents reviewed by ProPublica, suggest the day of cyber reckoning may already be here.<\/p>\n

Given the deluge of flaws Mythos has identified, Microsoft so far has focused on patching those it considers most dangerous, which are classified critical or important, according to the presentation as well as the company\u2019s own public patch updates. The internal records indicate that Microsoft plans to eventually address \u201cmoderate\u201d-severity flaws uncovered by Mythos. The documents made no mention of \u201clow\u201d-severity bugs.<\/p>\n

The company\u2019s approach reflects the triage system that is typical in the industry. Just as the sickest patients are the first to be treated in the emergency room, vulnerability triage prioritizes issues that are likely to cause the most damage if exploited by hackers.<\/p>\n

But that strategy carries its own risk in this AI-powered bug-finding era, in which new tools are unearthing a record-breaking volume of weaknesses in the products we use every day. Mythos, for example, is able to chain together a string of bugs that build on one another, meaning that the low- and moderate-severity vulnerabilities that remain unpatched could create an opening to carry out devastating attacks.<\/p>\n

\n

\u201cPaper Trail\u201d Podcast<\/h3>\n

Listen to Renee Dudley discuss her Microsoft reporting on ProPublica\u2019s podcast \u201cPaper Trail<\/a>.\u201d<\/p>\n

\n\t