Notes from Việt Nam on law, technology, languages, history, culture and travel.

Microsoft's 2026 Digital Defense Report: Attackers Got to AI First

On 1 October 2026 Microsoft published its annual Digital Defense Report. It covers July 2025 to June 2026 and draws on what the company says are 165 trillion security signals a day. Past editions mostly listed incidents. This one makes an argument: in the short term, AI helps attackers more than it helps defenders. In Microsoft’s words, “AI is changing the physics of cybersecurity.”

The report hedges more than the headlines did, so it is worth reading the figures with care.

The headline numbers

The figures below come from Microsoft’s report page and were reported the same way by Help Net Security, BleepingComputer and Tech Times:

  • Time to weaponization: the median time between a vulnerability being found in the wild and a working exploit has fallen to “well below 24 hours”. Microsoft puts typical enterprise remediation of critical external vulnerabilities at 30–60 days.
  • CVE volume: almost 40,000 CVEs were published in the first half of 2026. The full year is heading for about 72,000, which would be a record.
  • Phishing is back: phishing was the entry vector in 23% of the intrusions Microsoft investigated, up from 7% the year before. Exploitation of public-facing applications went from 15% to 24%.
  • ClickFix: about 1.1 million devices ran attacker-supplied “paste this command to fix the problem” instructions between February and May 2026. That is roughly eight times the earlier level.
  • Old bugs still matter: 58% of detections tied to the five leading CVEs involved CVE-2020-1472 (Zerologon), a 2020 vulnerability.

The phishing jump is the part that ties most directly to AI. The usual ways to spot a phishing email were bad grammar, a generic greeting, awkward phrasing and the wrong context. Microsoft’s point is that “AI fixes all four simultaneously.” The intrusions that followed also relied on stolen credentials far more than on exploits: in 52.2% of the intrusions that used valid accounts, the attacker had harvested credentials.

From “assisted” to “autonomous”

The most widely quoted part concerns autonomous attacks. Microsoft writes that frontier systems can now carry out multi-stage intrusions, “with one of our evaluations stringing 32 stages together in a controlled environment.” Help Net Security and Tech Times report that the models involved were Anthropic’s Mythos (Preview) and OpenAI’s GPT-5.5. Against an emulated enterprise with no active defenders, they took over the whole domain, including the main server and every user account. The report summary on Microsoft’s site does not name the models, so treat that attribution as press reporting.

The 32-step figure matches “The Last Ones”, a cyber range run by the UK AI Security Institute (AISI): about twenty hosts across four subnets, a task AISI estimates would take a skilled human around 20 hours. In AISI’s April 2026 evaluation, Mythos Preview completed the full chain in 3 of 10 attempts and GPT-5.5 in 2 of 10, each with a 100-million-token budget per attempt. Even the best model therefore failed seven times out of ten. AISI also says performance kept rising with more compute and showed no plateau.

Help Net Security adds that, by Microsoft’s estimate, open-weight models are about seven months behind closed models at attack orchestration. In practice, any capability a frontier lab restricts today should be expected in a downloadable model within a year.

JADEPUFFER: the real-world case

Lab results are one thing. The report also points to JADEPUFFER, which Microsoft tracks as Storm-3168. Sysdig documented it in July 2026 as the first confirmed fully automated ransomware extortion operation, and Microsoft says it has since seen more intrusions with similar traits “at low volumes”.

The Azure version of the attack, as described by BleepingComputer, should worry anyone running cloud infrastructure. The attacker used two compromised service principals from the same tenant: one for reconnaissance, the other for destruction. In about seven minutes it went after more than 100 storage accounts, plus Key Vaults, Function Apps, VMs and App Services. What survived was protected by Azure resource locks and storage-level protections that had been set up beforehand. SQL deletions failed only because the attacker called an unsupported API version. The credentials for one of the service principals had been posted in a public GitHub issue before the attack.

Why this matters for developers

A lot of the report concerns the software supply chain and developer machines:

  • s1ngularity, a trojanized npm package from August 2025, stole about 2,000 secrets and 20,000 files from 225 victims. According to Tech Times, it specifically targeted locally installed AI coding CLIs (Claude Code, Gemini CLI, Amazon Q CLI) and used them to search the machine.
  • A state-sponsored compromise of the Axios npm package in March 2026 is attributed to North Korea.
  • Malicious browser extensions harvesting ChatGPT and DeepSeek conversations had more than 600,000 installs across nearly 10,000 organizations.

Developer laptops and CI pipelines are now high-value targets, and AI agents running on them add another way in. The defenses are not new: never put credentials in issues or repos, give service principals least-privilege RBAC, put locks and soft delete on resources you cannot afford to lose, and pin and audit dependencies. What has changed is the time you have. When exploits appear within hours, a patch cycle measured in weeks is effectively no defense.

What to be skeptical about

The report is careful in places where the coverage was not. Microsoft itself says “most observed campaigns still retain human direction,” and that target selection and the most complex intrusions “remain manually driven in the majority of campaigns we observe.” Lab autonomy, with 2–3 successes in 10 against an undefended network, is still a long way from routine autonomous breaches of defended companies.

Microsoft is also a security vendor. It sells Security Copilot, which the report credits with 60–70% faster threat summarization. The prescription, “AI-assisted analysis to close the intelligence-to-action gap”, is also a sales pitch. The underlying trend, collapsing exploit timelines and a record CVE count, is well supported by independent data. Whether defender AI is the right fix is a separate question, and the report is not a neutral source on it.

Microsoft’s own expectation is that “the equilibrium between attackers and defenders will likely ultimately be re-established”, but only after “a multi-year period where the number of known but unpatched vulnerabilities spikes.” For engineering teams, the practical takeaway is to shorten patch cycles, keep secrets out of public places and assume that anything left exposed will be found quickly. (For a related incident, see OpenAI’s sandbox-escape pause.)

Sources