Microsoft’s FORGE Lab says an AI-assisted, three-month investigation of Linux kernel subsystems produced 59 public bug reports and 33 assigned CVEs. The results show both the reach of automated bug hunting and the expert work still needed to establish and report a vulnerability.
Microsoft AI Watch analysis
What happened
In a post published on 11 November, the lab describes using code-scanning and reproduction tools under the codename MDASH. Researchers found thousands of potential issues, according to the post, then investigated them to identify and validate reportable bugs.
One reported finding, CVE-2026-64563, is a state-reset flaw in the rhashtable library that the researchers say could allow stable local privilege escalation. The post says human investigators were needed to validate vulnerabilities, develop working exploits and get fixes upstream. The report does not establish that every potential issue found by the tools was exploitable or that all 59 reports became CVEs.
Why it matters
The useful result is not simply a large pile of machine-found warnings. It is the conversion of potential issues into public reports and assigned CVEs, alongside a clear account of where human investigation entered the process. For security teams, AI-assisted scanning may increase the supply of leads, but sorting leads from verified vulnerabilities remains essential.
That distinction matters as organisations decide how much to trust automated security tools. Faster discovery could help uncover bugs that would otherwise linger; without careful validation, it could also leave maintainers with a much noisier queue.
Our read
This is a concrete account of AI being used in security research, with numbers and a named example rather than a promise that a model can secure the kernel by Tuesday. The reported CVEs are a meaningful outcome. The equally important caveat is that the work still depended on people to validate findings and move fixes towards release.
What to watch
- Whether the reported findings lead to fixes and further technical detail from upstream maintainers.
- How the lab distinguishes exploitable vulnerabilities from the wider set of potential issues its tools identify.
- Whether later reports show similar results across other projects or research teams.
Discussion spark: Should AI-assisted vulnerability research be judged mainly by how many issues it finds, or by how reliably researchers can validate and get fixes for them?
Sources and evidence
- Lessons from 59 Linux Kernel Bug Reports (11 November 2026, 00:00 UTC)
not affiliated with or endorsed by Microsoft