The reported research output
Microsoft’s FORGE Lab said on 7 October that its work helped discover Windows vulnerabilities assigned 140 CVEs between May and September. The same account reported 155 internally validated submissions across 23 open-source projects, including the Linux kernel. These are different categories of output and should not be added as if each represented a separate public CVE.
Coordination follows discovery
The report discusses validation, remediation and coordination with open-source projects, including the Akrites initiative. A suspected issue, an internally validated report and an assigned vulnerability pass different stages before a fix reaches users. Microsoft’s figures describe its research programme. They do not establish an industry-wide discovery rate or make human triage and disclosure coordination unnecessary.
Sources & further reading
3 lessons from frontier AI vulnerability researchPublished by Capvise Media. Editorial standards · Corrections
