[DigitalToday reporter Chi-gyu Hwang] "Security automation using AI to find and fix bugs is no longer a distant future technology. It is a reality that can be used right now. Using a mix of AI models also helps find and fix vulnerabilities more effectively."

Tae-soo Kim (김태수), vice president for agentic security at Microsoft headquarters, on Thursday shared his views on the pace of AI advances and their impact on the security field at Codegate 2026, an international hacking defence competition and security conference held at COEX in Seoul.

Kim said large language models (LLMs) show strong capabilities while also making basic mistakes, calling them a "dual" presence. He stressed that distinguishing which problems to assign to AI and which to leave for human judgement is central to using AI.

He also highlighted that security research using AI agents is shifting from prompt engineering-focused approaches to system design-focused approaches.

He said early efforts relied on prompt techniques such as Chain of Thought, which induces step-by-step reasoning, or few-shot prompting that provides examples. Now, he said, architecture design that combines multiple agents determines performance.

Kim also introduced his experience in the U.S. Defense Advanced Research Projects Agency (DARPA) AI Cyber Challenge (AIxCC) and Microsoft's MDSAH project.

The team led by Kim chose in AIxCC to run multiple agents at the same time and combine results, rather than using a single model. He said bug-detection performance was higher when several models were used together than when only one model was used.

The system was broadly built around two workflows. One analysed crash phenomena in which a program suddenly stops or goes down due to an error to find the cause. The other generated patches based on that.

They also applied a structure in which a main agent delegated questions by splitting them among sub-agents. Kim said whether teams used a static analyzer and how they structured context provided to agents were key factors that separated results. He said results were also heavily affected by whether teams used existing analysis tools together with AI or relied only on AI, and by how much reference material they provided to AI.

After the competition, the team released the system as open source and also published a benchmark.

Kim said he also used what he learned from the competition to implement it as an actual product at Microsoft. The result was the MDASH project that Microsoft unveiled in June at its developer conference Build.

MDASH is a system that mimics the process of penetration testers finding vulnerabilities. It analyses code repository history and past vulnerability records and searches for vulnerabilities based on that.

It goes beyond simple detection by putting each vulnerability it finds through verification steps similar to actual developer review processes. It then generates patches itself and supports tests that can confirm whether the patches work properly.

Kim introduced work carried out by Microsoft's Windows kernel fuzzing team as the first case of MDASH being used in the field. Fuzzing is a security testing technique that finds errors or vulnerabilities by feeding large volumes of random and abnormal inputs into a program.

Kim said the Microsoft team found vulnerabilities through MDASH that it had not been able to find despite fuzzing for a long period. He said developers reviewed many of the vulnerabilities reported by MDASH and found more than 90 percent were confirmed as valid vulnerabilities.

He also released MDASH benchmark evaluation results, saying it showed mid-level security research capability even when using a relatively low-performing model. He said the success rate rose to as high as 98 percent when a more powerful model was applied, and stressed that infrastructure design becomes more important as model performance improves.