CriticalAPTCVE-2026-9545
3 lessons from frontier AI vulnerability research
Microsoft Security·Source published ·1 min read
What happened?
In this article Shift 1. From frontier capability to scale Shift 2. From token consumption to reasoning economics Shift 3. Validation and remediation as a continuous learning loop Transferring security research to help open source projects Open-source vulnerability reporting snapshot Measured costs of automated validation FORGE OSS Bug Hunt Party: Human coordination at scale (Hackathon) Akrites: Coordinated effort to remediate vulnerabilities What’s next for FORGE Lab?
Key details
- FORGE Lab discovered 140 Windows CVEs from May to September 2026, with 52 addressed in the September security release.
- FORGE members submitted 155 internally validated vulnerability reports across 23 open-source projects including the Linux kernel.
- One Linux kernel report became the first Akrites submission to result in a patch merged into the Linux kernel.
- Agentic discovery creates security value only when validation and remediation can keep pace with finding vulnerabilities.
- MDASH harness uses multi-model agents, specialized auditors, and code-analysis tools to allocate work by task type.
- Automated validation for Linux kernel findings averaged $3.61 and 21.5 minutes per confirmed crash using GPT-5.5.
- Vulnerability scanning should become a training loop where each run produces signals to improve future models.
Affected
- Windows vulnerabilities assigned 140 CVEs from May to September 2026.
- 23 open-source projects including Linux kernel, curl, Node.js, FFmpeg, SQLite, and others.
- Linux kernel findings validated through automated processes.
Fixes and mitigations
- Akrites initiative coordinated confidential remediation leading to a Linux kernel patch merge.
Summarised by SecOraLens from Microsoft Security. Always read the original source before acting. How SecOraLens verifies advisories.