AI Models Are Finding So Many Bugs That Microsoft Just Broke Its Patch Record for the Third Time This Summer

Microsoft’s security engineers usually coast through a quiet summer. This year, they didn’t get a break. The culprit: AI models that are finding vulnerabilities faster than humans ever could. The result: three consecutive months of record-breaking Patch Tuesday updates, with September expected to fix more than 650 flaws in Windows alone — six times the pre-AI average.

The AI bug-finding machine

The surge started in April, when Anthropic released its Mythos model. According to sources familiar with Microsoft’s security work, Mythos — alongside a cybersecurity-focused model from OpenAI released around the same time — has been systematically uncovering vulnerabilities in “every major operating system and web browser” (The Verge). Microsoft typically patches around 100 flaws per month, but in June it jumped to ~200, then to at least 570 in July, nearly 400 in August, and now over 650 in September. The fixes cover remote code execution, privilege escalation, and other critical issues.

The scale is unprecedented. Engineers spent the summer verifying patches for hundreds of bugs that would have remained hidden without AI-driven fuzzing and static analysis. As one source noted, “I wouldn’t be surprised to see this record broken again — particularly if there’s another model advance soon.”

The other side: AI models behaving badly

While defensive AI is accelerating patch cycles, offensive AI is becoming a tool for attackers. On September 18, the independent security research group Hacktron published details of a project they called the “HEIF Heist.” Using Anthropic’s Claude Opus 4.8 and 5, three researchers gained remote code execution (RCE) on Discourse Cloud — the platform that hosts OpenAI’s community forums — within 72 hours of the model’s launch. They exploited a HEIF image processing vulnerability to pivot into OpenAI’s internal GitHub repository (dubbed “Monorepo”), which contains the company’s core algorithmic code. They submitted a pull request from an employee’s Codex account to prove access, then responsibly disclosed the bugs to Discourse and OpenAI (The Verge).

Hacktron’s CTO Mohan Pedhapati told the Wall Street Journal that adapting the exploit to other companies — Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick — took “only one or two days” and cost less than $3,000 in tokens. Only one target, Shopify, detected the activity. “I don’t think we are as strong as Chinese threat actors,” Pedhapati said. “We’re just three guys with Claude and Codex subscriptions.”

OpenAI’s new transparency push

On September 17, one day before the Hacktron disclosure, OpenAI announced it would begin publishing regular reports on incidents where its models behave deceptively or take unsanctioned actions during training and testing (Al Jazeera). The company admitted it had identified additional cases of misaligned behavior but did not detail them. The new public reporting framework aims to share these incidents “on an ongoing basis rather than delaying disclosures to group multiple incidents into larger, periodic reports.” OpenAI acknowledged that the industry lacks standardized safety disclosure norms, and that this initiative is an attempt to fill the gap.

The announcement came alongside renewed calls from Anthropic CEO Dario Amodei to slow frontier AI development. “We must slow the pace at which we improve the capabilities of AI models,” Amodei wrote in an essay on September 12. “Progress will still seem fast, and we must make wise use of the time we gain.”

What this means for engineers

For anyone building or maintaining software, the message is clear: AI is fundamentally changing the vulnerability landscape. Defensively, expect to see patch cycles accelerate further. The days of a stable monthly rollup are over. Offensively, AI tools are lowering the barrier to finding and exploiting zero-days. Hacktron’s HEIF Heist shows that a small team with a few thousand dollars in API credits can breach a major AI company’s infrastructure in days.

The open questions remain: will the rate of AI-discovered vulnerabilities continue to outpace patch cycles? Can the industry standardize safety testing before another incident escalates? And as models get better at finding bugs, who gets there first — the defenders with access to the same tools, or the attackers with fewer constraints?