Microsoft says AI-assisted attacks are outpacing security fixes

Finding a flaw is faster than fixing it

AI-assisted discovery of security flaws is increasingly outpacing organizations’ ability to fix them, Microsoft says in its 2026 Digital Defense Report. According to BleepingComputer’s October 1 coverage, Microsoft says attackers are gaining the benefits of AI faster than defenders, narrowing the time security teams have to protect exposed systems.

Microsoft says AI reduces the time, expertise and cost needed to discover and exploit weaknesses. Repairs face a different constraint: many systems lack robust unit testing, which checks individual pieces of software, and integration testing, which checks how those pieces work together. Without that testing, organizations cannot deploy code changes rapidly, the company says.

Microsoft reports that the median, or middle, time between discovering a vulnerability in the wild and weaponization—making it usable in an attack—has fallen “well below 24 hours.” That leaves organizations less time to patch exposed systems before attackers exploit the flaws.

The company forecasts a likely multi-year rise in known but unpatched vulnerabilities. It also warns that well-prepared, well-funded attackers may stockpile zero-day vulnerabilities: flaws for which a fix is not yet available. These are Microsoft’s predictions, rather than established outcomes.

How attackers are using AI

Microsoft reports that attackers use AI to generate customized malware and speed up work after breaking into systems. Activities such as stealing data, finding secrets such as passwords, and moving between systems can shrink from days to minutes, the company says.

The report also describes AI use in state-linked operations:

• Some Chinese state-sponsored actors use AI to search for vulnerabilities and learn how to exploit them. They still rely on phishing—deceptive messages intended to trick recipients—and remote access trojans, malicious programs that enable remote control.
• Microsoft says it has observed Russian state-sponsored actors using AI-assisted coding and AI-generated tools to accelerate attacks.
• North Korean remote IT workers use AI to develop personas, manipulate people and maintain access to organizations, according to Microsoft. Other North Korean actors use it to create malware and manage attack infrastructure. Some have also used AI-generated code and multi-step AI workflows to speed malware deployment.

Faster does not mean fully autonomous

Microsoft cautions that most observed real-world campaigns still depend on humans to choose targets, make decisions and handle complex tasks. That remains the case despite demonstrations of end-to-end autonomy in laboratories and early real-world cases. The report describes AI speeding up parts of attacks, not a general shift to attacks that operate entirely without human direction.