AI in Cybersecurity Just Found What Humans Couldn’t See
It’s not that Microsoft’s code got worse. It’s that AI finally started seeing the rot.
On July 14, Microsoft released patches for 570 security flaws—the most ever in a single Patch Tuesday. Three were zero-days, actively exploited before Microsoft even knew they existed. One of them, CVE-2026-56164, let attackers escalate privileges in SharePoint servers by exploiting a missing authentication check. CISA had already warned organizations: hackers were in.
But here’s the twist: Microsoft didn’t find these flaws because someone sat down and read every line of code. They found them because an AI model, trained on decades of Windows source code, flagged anomalies buried in code that hadn’t been touched since 2003.
Pavan Davuluri, Microsoft’s Windows chief, put it bluntly: "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release."
Translation? This isn’t a glitch. It’s the new normal.
We used to think of AI in cybersecurity as something that detects ransomware patterns or flags phishing emails. Now it’s digging through the digital equivalent of an ancient Roman aqueduct—looking for cracks nobody knew were there because the builders are long dead, and the blueprints are lost.
And it’s not just Microsoft. The same AI-driven scanning tools are being used by Google, Mandiant, and even anonymous researchers. One of the SharePoint zero-days was flagged by a team from Google Cloud. Another, CVE-2026-56155 in Active Directory Federation Services, was discovered by Microsoft’s own DART team—its incident response unit—while chasing down an active attack. The AI didn’t just find the flaw; it helped them trace its origin.
This isn’t automation. It’s revelation.
The 570: A Breakdown of the Invisible Threats
Let’s be clear: 570 vulnerabilities is a lot. But the real story isn’t the number—it’s the categories.
254 were elevation of privilege flaws. That’s not just a bug—it’s a backdoor to admin rights. 145 were remote code execution. That’s how attackers take over entire systems from across the internet. 102 were information disclosures—leaks that let hackers map out internal networks.
And then there’s the one nobody talks about: the 17 security feature bypasses.
One of those, CVE-2026-50661, targeted BitLocker. Not a remote attack. Not a phishing email. Just physical access to a device. An attacker with a USB drive and 20 minutes could bypass encryption and read everything. Microsoft patched it, but they didn’t fix the assumption that physical security is someone else’s problem.
The numbers don’t lie: most of these flaws weren’t new. They were old. Forgotten. Left behind when Windows XP was retired, when Office 2007 was decommissioned, when the last engineer who understood the legacy authentication system moved on to a startup in Austin.
AI didn’t invent these bugs. It just made them visible.
And here’s the uncomfortable truth: if AI hadn’t been scanning, these flaws might have stayed hidden for another decade. Or longer.
How AI Sees What Humans Miss
Here’s how it works.
Microsoft’s AI doesn’t read code like a human. It doesn’t understand logic or intent. It maps patterns.
It knows what a properly authenticated API call looks like. It knows what a buffer overflow looks like in x86 assembly. It knows that if a function in a 20-year-old DLL calls a deprecated library, it’s probably unsafe.
It doesn’t care if the code was written by a genius or a grad student on a caffeine bender. It just knows: this doesn’t match the pattern of secure code.
And it’s not just looking for obvious exploits. It’s looking for latent vulnerabilities—bugs that only become dangerous under specific conditions. A race condition that only triggers when two users sync files simultaneously. A memory leak that only appears after 47 days of uptime.
The DART team found CVE-2026-56155 because the AI flagged a function in AD FS that had been untouched since 2012. It was never exploited before because no one ever triggered the exact sequence of events needed to activate it.
But an AI didn’t need to trigger it. It just knew: this function is a time bomb.
This is the shift. We’re no longer just defending against attacks. We’re defending against the decay of software itself.
And AI? It’s the only tool that can keep up.
The Mitigation Nobody Wants to Talk About
You might think: "Just patch it. Done."
Not so fast.
For SharePoint, Microsoft’s official mitigation? Enable AMSI (Antimalware Scan Interface) and set Request Body Scan to Full. Sounds simple. But AMSI? That’s a Windows feature most admins disable because it slows down file uploads. And Request Body Scan? It increases server load by 30%. Most companies won’t enable it unless they’re forced.
That’s the problem with AI-powered discovery: it finds flaws faster than organizations can fix their own processes.
We’re in a race between two systems: one that finds vulnerabilities, and one that still believes patching is a quarterly chore.
And the AI is winning.
The same goes for legacy systems. You can patch CVE-2026-50661 on BitLocker, but if you’re still running Windows 7 in your manufacturing plant? You’re still vulnerable. The patch won’t install. The AI found the flaw. But no one’s going to upgrade a 15-year-old PLC controller just because an AI flagged a 20-year-old encryption flaw.
This isn’t a technical problem. It’s a cultural one.
The Future Is Already Here
The record 570 flaws? They’re not a peak. They’re a baseline.
Next month, it’ll be 610. Then 650.
And it won’t be because Microsoft is shipping worse code. It’ll be because AI is getting better at seeing what’s already there.
We’re entering an era where the biggest threats aren’t the ones hackers invent. They’re the ones we built—and forgot.
The AI isn’t the enemy. It’s the mirror.
And what it’s showing us isn’t pretty.
But it’s real.
And until we start treating software decay like the emergency it is, we’ll keep seeing these numbers climb.
The question isn’t whether AI will find more flaws.
It’s whether we’ll be ready to fix them.
Sources: TechCrunch, BleepingComputer