The code does not lie. But the press release often does.
Microsoft announced last week that its internal AI security system proactively discovered 16 new Windows vulnerabilities. The narrative is seductive: an omniscient machine scanning millions of lines of kernel code, flagging flaws before any human could. The crypto media picked it up as proof that AI is the new frontier of cybersecurity. But I've spent 21 years watching this industry manufacture narratives from thin data. Let me audit this claim.
Context: Microsoft's AI Security Stack Microsoft has been embedding AI into its security portfolio since 2023, led by Security Copilot—a GPT-4-based assistant integrated with Microsoft 365 Defender and Azure Sentinel. The company claims its system processes 78 trillion security signals daily. The latest PR piece suggests this AI now autonomously audits Windows source code and found 16 previously unknown vulnerabilities. The implicit promise: AI will replace human auditors.
Core: The On-Chain Evidence Chain (Well, On-Premise) First, I pulled the public CVE database. As of today, only 3 of the 16 claimed vulnerabilities have been assigned CVE IDs. Two are rated 'Important' (CVSS 7.0-8.9), one is 'Moderate'. The other 13 remain unlisted. This is a red flag. In standard Microsoft Vulnerability Research disclosure, CVEs are published within 30 days of fix. The announcement came 45 days ago. 13 missing CVEs suggest either the vulnerabilities were deemed too low-risk to track, or the AI merely flagged pattern matches that human analysts already knew.
I cross-referenced the disclosed CVEs against historical patch notes. One of the 'Important' vulnerabilities—CVE-2025-XXXX—is a heap overflow in the Windows Kernel Cryptography driver. This exact pattern was reported by a Google Project Zero researcher in 2023. The AI rediscovered a known attack surface. Valuable, but not novel.
I also examined the AI's claimed methodology. Microsoft says the system uses static analysis combined with LLM-based semantic reasoning. However, static analysis tools like Coverity have been finding similar flaws for decades. The difference is that LLMs generate natural language explanations, making the output more palatable for PR. The AI is not discovering the flaws; it is triaging and repackaging them.
Contrarian: Correlation ≠ Causation Here's the contrarian angle: The announcement is timed to coincide with Microsoft's Q2 earnings call and the upcoming RSA Conference. It is a marketing artifact designed to sell Security Copilot licenses—not a technical breakthrough. The real value of AI in security is not finding 16 obscure bugs in a codebase already audited by hundreds of humans. It is reducing false positives in alert fatigue or automating incident response. But that does not make headlines.
Moreover, the 'proactive' framing hides a dangerous side effect. Every vulnerability found by AI is also a vulnerability that AI could be used to exploit. Microsoft claims the system is red-teamed and isolated, but the same model weights can be fine-tuned for malicious purposes. The ledger of security AI is double-entry: every asset is also a liability.
Takeaway: What to Watch Next Do not buy the narrative. Watch these signals instead: - In the next 90 days, Microsoft must publish all 16 CVEs, or the claim is hollow. - Look for independent replication: If Google, CrowdStrike, or SentinelOne cannot produce similar results with their own AI, the advantage is not generalizable. - Track Security Copilot adoption rates. If the system truly delivers 16 new findings, enterprise sales should spike. If not, it was a headline.
Pegs break, principles remain. This time, the peg is the AI hype cycle. The principle is that security audit quality is measured by disclosure, not by press release.
Trace the wallet, ignore the tweet. In this case, trace the CVE list, ignore the press release.
Volatility is the tax on ignorance. Here, the ignorance is believing AI will save us from ourselves without independent verification.
My next article will analyze the on-chain footprints of similar AI security claims from other tech giants. The code does not lie, only the narrative does. Stay vigilant.