Microsoft's internal AI scanning system can automatically generate exploits for roughly 200 Linux kernel vulnerabilities at an average cost of just $3.61 per exploit, with a time to generation of 21 minutes, according to a senior security manager at the company. David Weston, who leads Microsoft's AI vulnerability-discovery and frontier-model research, delivered the warning during a keynote at Black Hat USA, urging the industry to abandon reactive patching in favor of inherently resilient systems. The company's Security Response Center is now handling double the vulnerability volume it processed just six weeks ago—nine times the volume recorded in March—driven primarily by AI-accelerated discovery tools, Weston said.

Microsoft's MDASH (Multi-model Agentic Scanning Harness) identified around 200 flaws in the company's internal Azure Linux distribution, and the system successfully created 182 crash-level proof-of-concept exploits from those vulnerabilities. Many of those automatically generated exploits are fully functional root-level attacks, Weston noted. The technology added a new module that converts static analysis results into working exploit code, performing far better than engineers initially anticipated. Meanwhile, Google's shift to the Rust programming language brought memory safety flaws down from 76% of Android vulnerabilities in 2019 to below 20% in 2025, demonstrating the impact of safer coding practices.

"By the end of the year, we'll be looking at automatic exploit generation being pretty commonplace and pretty commodity," Weston warned. He described the current vulnerabilities as "serious," the type that previously required a year of specialized crafting, now being produced at industrial speed across all operating systems, not just Windows. Weston argued that defenders "don't wanna go vulnerability for patch" or "exploit for detection," cautioning that "hand-to-hand combat with attackers will cause us to lose in defense." His remarks were echoed by Arizona State University researcher Yan Shoshitaishvili, who told Black Hat attendees his agentic AI pipeline is discovering vulnerabilities faster than his team can responsibly disclose them with proper documentation and fixes.

The accelerating economics of offense stem from AI's ability to sidestep traditional cost barriers that once limited attackers, Weston explained. Historically, enterprises relied on threat detection assuming adversaries faced high costs to retool their frameworks and techniques, but autonomous operations now allow attackers to generate bespoke tool sets per target without expensive operator retraining. Traditional nondeterministic protections like Address Space Layout Randomization may continue posing obstacles, but they're unlikely to slow the rising tide of AI-mediated vulnerability discovery for long. About 70% of vulnerabilities patched by major vendors today are memory safety issues, which memory-safe languages like Rust and Golang eliminate entirely—Microsoft rewrote the Azure hypervisor in Rust and deployed it across 1.5 million virtual machines without incident. However, Shoshitaishvili's testing of a Rust rewrite of Ubuntu's coreutils revealed that while memory-safety bugs disappeared, logic vulnerabilities like time-of-check–time-of-use races and cryptographic flaws persisted unless developers actively rewrote problematic code.

Microsoft and researchers recommend the industry adopt memory-safe programming languages alongside AI-based tools to strengthen existing code bases, shifting investment from detection to prevention and "secure by construction" methods. DARPA's Tractor project automates the conversion of legacy C code into Rust, while Microsoft Research's RustAssistant uses AI to detect and suggest fixes for Rust compilation errors. Detection remains important but no longer sufficient, Weston said—vendors and enterprises should prioritize durability and use formal methods to achieve deterministic safety, turning the tables on attackers if executed on a realistic timeline. The window to rebuild defenses around inherent resilience rather than reactive measures is closing as automated exploit generation becomes commodity technology within months. Organizations that continue treating vulnerability remediation as a one-for-one patching exercise risk falling permanently behind adversaries who can now generate tailored attacks at negligible cost, fundamentally rebalancing the defender's calculus in favor of architectural change over tactical response.