Leaked Documents Indicate Microsoft Can’t Keep Up With Discovery of Security Vulnerabilities

Between the scope of the most recent “Patch Tuesday” updates and new leaked documents from internal Microsoft meetings, it appears the software giant is falling behind Mythos discovery to the tune of hundreds of security vulnerabilities per month. While many of these are classed “moderate” or below, they are the sort that can potentially be chained into a lethal attack chain by AI working at machine speed.

Answers to the frontier AI security problem remain nebulous, even as these models are becoming available to the general public. The security picture will look different for different organizations with different products and needs, but the fact that a well-resourced company like Microsoft is already in a state of at least partial surrender is certainly a troubling sign.

Chronic understaffing problems exacerbated by AI emergence

The leaked documents were almost unnecessary to diagnose the problem, as the last two “Patch Tuesdays” shattered previous records for amounts of security vulnerabilities addressed. But they do make clear that Microsoft triaging is currently only addressing the most serious and critical, with hundreds of “moderate” and lower bugs put on pause for an indeterminate period of time due to simple inability to get to them.

Microsoft does have some unique vulnerabilities in this area. It has many major global software products, and those products have a lot of legacy support built in that is almost guaranteed to have scads of security vulnerabilities waiting to be discovered. But another of its core issues, chronic understaffing, is one shared by the entirety of the IT industry due to simple lack of candidates. This was already a serious issue prior to the emergence of frontier AI vulnerability discovery with Mythos, and is now poised to potentially become a crushing one.

The most immediate and hopeful answer is that AI will check AI, and that is a concept that Microsoft is subscribing to.  It has announced the formation of “Project Perception,” a plan to field at least three AI teams to proactively sniff out security vulnerabilities and act independently to address them. Most organizations cannot afford to field their own localized AI-powered dragnet, however, and answers for them remain in flux.

Window for AI-discoverable security vulnerabilities continues to close

While Microsoft’s raw number of security vulnerabilities won’t be comparable to what most organizations are dealing with internally, it does provide an example of how difficult this issue may become as well as how questionable the security of the world’s most-used software products might be for a time.

In terms of those numbers, the leaked documents indicate the company found at least 500 “moderate” or higher security vulnerabilities in their first month of Project Glasswing security testing. All those rated moderate or below were simply put on indefinite pause due to lack of manpower. Those higher-level bugs that were triaged were expected to take months to address.

The documents include team meetings about security vulnerabilities specific to Sharepoint, but some other notes indicate that hundreds of bugs are also being uncovered by AI in other major products such as Microsoft 365 and Teams. Sharepoint had a total of about 231 higher-severity bugs, and the company expected it to be a matter of months to get to them all.

What should organizations take away from this? These issues are most certainly not specific to Microsoft, and numerous other software providers may have AI-discovered but unaddressed “moderate” and lower-severity bugs piled up that could be swiftly assembled into a kill chain by AI. But at the moment, there are few good universal answers other than hoping the guardrails on the most advanced available models hold tight.