CVEs credited to an LLM

The attribution blind spot: Microsoft's MDASH

The table below counts CVEs a source credits to an LLM by name. Microsoft's MDASH (Multi-Model Agentic Scanning Harness) is the case that breaks that model — and it is worth showing precisely because we refuse to paper over it with a guess.

Microsoft credits MDASH only in aggregate. Of the 13,119 Microsoft CVEs in our corpus (by MSRC advisory reference), 0 carry a per-CVE MDASH or “agentic” mention. Microsoft has named specific MDASH-found CVEs exactly once — 16 of them, in May 2026 Patch Tuesday launch batch — and nothing since, even as its monthly CVE volume climbed:

Microsoft (MSRC) CVEs per month. The ramp coincides with MDASH's rollout, but Microsoft attributes none of it per-CVE, so whether the surge is AI-driven is unverifiable from public data. That unverifiability is the finding: a vendor can now find bugs with AI at scale and disclose nothing per-CVE, making any “AI-discovery share” for that vendor unknowable. We do not estimate it.

The 16 CVEs Microsoft named as MDASH-found — illustration only, not counted in the share

Primary source: Microsoft Security blog. A PR-selected sample, not a discovery rate.

CVE-2026-33827 CVE-2026-33824 CVE-2026-41089 CVE-2026-41096 CVE-2026-40415 CVE-2026-40413 CVE-2026-40405 CVE-2026-40406 CVE-2026-35422 CVE-2026-32209 CVE-2026-35424 CVE-2026-35423 CVE-2026-40414 CVE-2026-40401 CVE-2026-33096 CVE-2026-40399