Microsoft's 2026 Digital Defense Report: Median Time From Vulnerability Discovery to Weaponization Is Now Well Under 24 Hours, and Frontier Models Chained 32 Attack Steps on Their Own
On October 1 Microsoft released its 2026 Digital Defense Report, covering July 2025 to June 2026. Its central finding is that AI has given attackers a temporary lead: the median time from discovering a vulnerability to weaponizing it is now "well below 24 hours," and CVEs registered in 2026 are on track for a record of about 72,000. Among the intrusions Microsoft investigated, phishing as the entry point rose from 7% to 23%, and exploitation of public-facing applications from 15% to 24%. In a controlled evaluation, Anthropic's Mythos Preview and OpenAI's GPT-5.5 chained 32 attack steps without human direction to take over an entire domain in an emulated enterprise network. The report also notes that target selection and key decisions are still made by humans in most attacks.











