Microsoft sets third consecutive patch record amid AI discoveries

Steelman: both sides, in good faith

The strongest fair case each way — we don't pick a winner.

The case for

Advocates of using AI models like Mythos to hunt for vulnerabilities argue this is an unambiguous net gain for security, since flaws that might have lain hidden for years, quietly exploited by criminals or state actors, are instead being surfaced and disclosed to vendors first. They contend that a sharp, temporary rise in patch volume is the visible cost of a healthier underlying process: more eyes, artificial or otherwise, finding bugs faster than attackers can weaponise them, ultimately shrinking the total pool of unknown, exploitable weaknesses in widely used software. On this view, the discomfort businesses feel keeping pace with frequent updates is a small price for closing gaps that would otherwise sit open indefinitely.

The case against

Critics counter that unleashing AI systems capable of building working exploits within hours of disclosure dangerously compresses the time defenders have to act, effectively handing attackers a ready-made playbook the moment a flaw becomes public. They point out that most organisations, especially smaller ones without dedicated security teams, cannot realistically test and deploy six times the normal volume of patches each month without risking outages or simply falling behind, leaving them more exposed rather than less. From this perspective, accelerating vulnerability discovery without a matched acceleration in organisations' capacity to patch safely may widen, rather than narrow, the real-world window in which systems remain vulnerable.