Microsoft said on Wednesday, Nov. 11, that its FORGE Lab used AI to hunt for security bugs in the Linux kernel, the core of the Linux operating system, and has so far sent 59 public bug reports to the people who maintain it. Fixes for 38 of those reports are now in the main version of Linux. Most of the bugs had been in Linux for years: 8.1 years on average, and at least 21 years for one of the oldest.
For eight of the bugs, Microsoft says it confirmed working attacks in its lab that let someone with an ordinary account on a computer take full control of it, the level Linux calls root. Some of those attacks needed settings that are not the default, or protections switched off. Of the 33 bugs given official tracking numbers so far, Microsoft says 24 are rated high or critical severity.
The scans ran from late May to mid-June 2026 on security-sensitive parts of Linux, such as networking, file systems and security features, using a tool Microsoft calls MDASH. The tool's AI models, mostly one called Sonnet 4.6, read the code. In about two weeks on two servers they flagged 26,502 possible bugs, and screening cut that to 11,769. Then AI agents, AI that can carry out tasks on its own, mostly running a model called GPT-5.5, tried to make each bug happen on virtual test machines, and 621 cases came with a working demonstration that the bug was real.
People did the rest. Microsoft's experts found that 266 of the 621 cases shared a cause with another case, so one fix covered them. They did not report 163, mostly because the security risk was small, and 133 had already been reported or fixed by others. Linux usually requires security bug reports to come with a working fix. AI helped draft the first versions, but Microsoft says people had to check them and work through them with the maintainers. Half of the 38 merged fixes went in on the first try, and the rest after one to four rounds of changes.
The U.S. government's National Vulnerability Database, its public list of known software flaws, lists one of the eight bugs with working attacks as resolved in Linux, with a high severity rating from Linux's own security team. That bug sits in a shared lookup table that many parts of Linux use to keep track of items and list them when a program asks. Microsoft says it could be used to take over a computer without any special settings, and that it also affected Android phones. The database also lists the bug that had been in Linux at least 21 years as resolved, with the same high rating. Microsoft credits Yuan Tan of NebuSec, who also found the lookup-table bug independently and gave Microsoft working attacks on it for Linux and Android.
Microsoft says finding bugs now far outpaces fixing them, and that people are the slow part. Reporting the 59 took more than four months of people's work. Half of the fixes took 41 days or less to go from their first public version into a released version of Linux, and the slowest took 108. Microsoft says both bug hunters and maintainers can be swamped by the number of real findings, so the work has to focus on the most serious ones.
Microsoft scanned only a small fraction of Linux and says more tuning and more AI use could find substantially more bugs, though it questions whether fixing them all would make the system secure. On Nov. 4, OpenAI said that in one run its own AI produced working attacks for 948 Linux flaws that could let an ordinary user take full control, and that it had sent hundreds of reports and fixes to Linux's developers. Microsoft says it aims to bring this kind of AI bug hunting to security teams, but has not said when.