cd ~/
Agentic AIMulti-Agent SystemsSecurityAgent ArchitectureAI Engineering

Microsoft Tuned 100 Agents to Argue

Microsoft's 100-agent security system found 16 real Windows vulnerabilities by making AI agents disagree with each other.

Evyatar Bluzer
3 min read

Most multi-agent systems are tuned to agree with themselves. Microsoft tuned one to argue, and it pulled 16 real vulnerabilities out of Windows.

What Shipped

Microsoft's Autonomous Code Security team released MDASH (multi-model agentic scanning harness) on May 12. It orchestrates over 100 specialized AI agents across an ensemble of frontier and distilled models to discover, validate, and prove exploitable vulnerabilities end-to-end.

The result: 16 new vulnerabilities in the Windows networking and authentication stack, four of them critical remote code execution flaws in the TCP/IP stack and IKEv2 service, all shipped as fixes in May's Patch Tuesday. On benchmarks, MDASH hit 96% recall against five years of confirmed MSRC vulnerabilities in clfs.sys, 100% recall in tcpip.sys, and 88.45% on the CyberGym leaderboard - five points clear of every other system.

Inside the Pipeline

MDASH runs a five-stage pipeline:

  1. Prepare - ingests source, builds language-aware indices, maps attack surface from commit history
  2. Scan - specialized auditor agents examine candidate code paths and emit findings with evidence
  3. Validate - debater agents argue for and against each finding's exploitability
  4. Dedup - consolidates semantically equivalent findings
  5. Prove - generates triggering inputs and executes them to confirm the bug is real

Stage three carries the whole design. Two agents look at the same candidate vulnerability; one argues it is exploitable, the other argues it is a false positive, and the disagreement itself becomes the signal. Findings the agents cannot converge on get escalated, and findings they agree are noise get dropped.

MDASH pipelineFive boxes in a row joined by arrows, the third highlighted; from it a bracket drops to two side-by-side boxes, which merge into three outcome boxes below. Prepare Scan Validate Dedup Prove source indices, attack surface map auditor agents on distilled models debater agents on reasoning models merge equivalent findings run triggering inputs argues: exploitable argues: false positive converge: exploitable cannot converge agree it is noise on to Dedup and Prove escalated dropped
MDASH's five stages, with Validate opened up: two debater agents argue opposite sides of each finding, and the disagreement itself is the signal that routes it on, escalates it, or drops it.

Different model classes serve different stages - heavyweight reasoning models for the debate, distilled models for cost-effective scanning, independent counterpoint models for validation - and domain-specific plugins inject context about kernel conventions and system invariants that no foundation model carries on its own.

What Should Builders Steal?

The routing pattern, mainly. If you build multi-agent systems - and I do - the move worth internalizing is sending tasks to multiple agents with opposing perspectives and letting structured disagreement surface what consensus would miss, instead of routing everything to the single best agent. Most orchestration today optimizes for agreement; MDASH optimizes for productive friction, and the debate mechanism converts that friction into evidence quality. It is also a structural answer to the evaluator that quietly overrates its peer: an agent assigned to argue the other side has no peer to protect. That is a coordination primitive the standard playbook does not have.

Beyond Security

Adversarial multi-agent architectures will spread past security into code review, compliance validation, and spec verification - any domain where false positives are expensive and false negatives are dangerous. For the hardest bugs, my money is on the agents most willing to argue rather than the smartest ones.

Comments