At Black Hat’s Wednesday keynote, Microsoft’s David Weston laid out a number that should unsettle anyone still betting on “patch when it matters” as a security strategy: using an internal vulnerability-to-exploit harness, Microsoft’s security team generated 182 crash-level proof-of-concept exploits from 200 Linux kernel vulnerabilities found in its Azure Linux distribution, many of them fully working, privilege-escalation-level exploits. The average cost was $3.61 in AI tokens and 21 minutes of compute. Weston, who leads Microsoft’s agent security team after two decades building operating system security through WannaCry and Stuxnet, framed the number as evidence of something larger: the assumption underlying most of modern cybersecurity, that breaking a security boundary is expensive and rare, is starting to come apart.
Weston’s argument starts with economics. Every security control an organization runs – network segmentation, process isolation, identity boundaries, encryption – exists because undermining those boundaries has historically been hard and costly. Bug bounty pricing reflects it directly: a hypervisor bypass can fetch roughly 20 times what a process boundary crossing does. Of the tens of thousands of CVEs disclosed every year, independent tracking puts real-world exploitation at around 90 annually. That scarcity is why two dominant security strategies have made sense for years: deprioritizing secure development in favor of fast patching, since exploits were rare anyway, and leaning on detection over prevention, since attacker tooling and tactics were historically too expensive to constantly reinvent.
Weston’s data suggests both assumptions are breaking. Microsoft’s own vulnerability processing volume through MSRC has been doubling roughly every six weeks this year, putting the company at nine times its March volume. He was careful to draw a direct line rather than just a correlation: Microsoft turned on a new AI-driven vulnerability discovery harness against Windows on April 1, and in the months since, it found more credible, high-severity issues than in the entirety of the previous year, including seven remote TCP/IP driver vulnerabilities crossing both kernel and remote boundaries, the kind of bug Weston said used to take a year of bespoke research to uncover. External benchmarks tell a similar story. One benchmark Weston cited, evaluating models against roughly 900 real-world vulnerabilities including browser bugs, had its best score effectively doubled by OpenAI in the weeks since he’d last checked it. What’s currently holding automated exploit generation back, in his view, is largely non-deterministic mitigations like ASLR, not any fundamental limit on model capability.
Restricting access to frontier models won’t preserve that scarcity either, Weston argued. On CyberGym, a leading vulnerability discovery benchmark, the top performers aren’t raw frontier models but harnesses, systems that inject cyber expertise around a model through tooling and context rather than requiring that expertise be baked into the model itself. That means cyber capability doesn’t have to live inside a restricted frontier model to be dangerous; it can live in the scaffolding built around a far less restricted one. Detection durability is under similar pressure. The Pyramid of Pain model has long held that attacker tools and tactics are expensive to change and therefore durable to detect. Weston pointed to a Dragos report from earlier this year describing an AI-assisted group targeting a water utility that regenerated its own attack framework mid-operation, ultimately producing roughly 17,000 lines of custom command-and-control code for a single engagement, alongside Anthropic’s own disclosed account of a threat actor running largely autonomous operations against high-value targets using agentic tooling.
Weston’s optimism, and he was explicit about being an outlier in that regard against the keynote stage’s more doom-laden framing, rests on defenders having access to the same productivity gains attackers do. His argument against a purely reactive posture is blunt: chasing exploit-for-detection or evasion-for-detection in a straight arms race is asymmetric warfare that favors whoever moves faster, and that won’t be the side burdened by compliance, auditing, and cost controls. Instead, he pointed to evidence that AI-assisted prevention is already working at scale. Google’s Android team cut memory-safety vulnerabilities from 76% of patched issues in 2019 to under 20% in 2025, largely by writing new code in Rust; Microsoft’s own Azure hypervisor rewrite in Rust has scaled past 1.5 million virtual machines without a memory-safety incident. AI is making that migration path cheaper: a Microsoft Research project called Rust Assistant automatically fixes 74% of Rust compilation failures without human intervention, and separate research inferred and auto-generated 86% of memory-safety contracts for existing C codebases.
Formal verification, Weston argued, is having a moment analogous to reinforcement learning’s decades-later resurgence in AI, because AI finally makes writing the underlying specifications and proofs tractable at scale. He cited real catches: Apple found an error in the NIST-standardized post-quantum signature algorithm ML-DSA through formal verification, and Microsoft found a single-bit error in a post-quantum key encapsulation implementation that had passed every fuzzer and every human reviewer, caught only by formal proof. In one week, largely agent-driven, Microsoft generated 30,000 lines of formal proof code verifying the AES-GCM implementation inside its SymCrypt library as free of logical, cryptographic, and memory-safety issues.
Weston closed with a pointed case study drawn from public reporting: a recent AI model sandbox escape in which a tightly isolated evaluation environment, exposing only a single necessary proxy for package access, was still compromised through roughly nine chained logical vulnerabilities the model found on its own. Even textbook isolation, he argued, isn’t enough without something like formal verification behind it. His advice to the room was concrete: identify your highest-risk surfaces and make them secure by design; identify your most critical boundaries and start applying agent-assisted formal verification now using existing open-source tooling; and pair infrastructure-as-code with graph-based reasoning to let agents proactively find and fix configuration risk before attackers do. On that last point, he cited an internal analysis showing agents could resolve 78% of findings from Checkov, a widely used infrastructure-as-code scanning tool, without human intervention.
##
ABOUT THE AUTHOR
Tom Smith is a technology writer and content strategist with more than 10 years of experience covering enterprise technology, agentic AI, cybersecurity, DevOps, and cloud infrastructure. He has published more than 2,500 articles and conducted more than 4,000 executive interviews across outlets including Coder Legion, Techstrong/DevOps.com, and Insights From Analytics. By day, Tom serves as a content strategist at Cognizant. He can be found on LinkedIn, X, and Bluesky at @ctsmithiii.
