Will AI make the final decision on security updates?

No. Microsoft stated that developers will still verify AI findings and make risk-based decisions about updates, and humans will remain in the loop when it comes to code review.

Why is Microsoft making this change now?

Hackers, even amateurs, have increasingly been using AI to quickly exploit security weaknesses over the past several months, and security researchers are also using AI to find issues faster, leading to more frequent high-severity vulnerabilities.

AI Business & IndustryThe Verge AIJul 9, 2026Jul 10, 2026, 04:00 JST

Microsoft to flood Windows updates with AI-powered security fixes

Send on LINE

3 Key Points

What happened
Microsoft announced it is using AI to identify potential security issues earlier in its development process, which will result in customers seeing a higher volume of security updates included in each security release. The company is also investing in new technology including Windows-specific tools and agentic harnesses to generate and validate security fixes with AI, while keeping humans in the loop for code review.
Why it matters
Hackers have increasingly been using AI to quickly exploit security weaknesses in recent months, and security researchers using AI are also finding high-severity vulnerabilities faster. Microsoft is updating its Secure Development Lifecycle to explicitly account for potential AI-enabled attack techniques and exploit paths, making this shift a response to the accelerating pace of AI-driven threats to operating systems.
What to watch
Microsoft emphasized that developers will still verify AI findings and make risk-based decisions about updates, meaning human review remains the final gate for any security fix before deployment.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

The shift reflects a fundamental change in the threat landscape: AI tools are now weaponized on both sides of the security divide. Hackers and security researchers alike are using AI to move faster, compressing the window between vulnerability discovery and exploitation. Microsoft's response—embedding AI throughout its security identification and fix-generation pipeline—is an attempt to match that pace while maintaining human oversight at the critical juncture of code review and release decisions.

The company's emphasis on keeping developers in the loop signals that it recognizes a tension between speed and safety. By automating the labor-intensive work of identifying issues and drafting fixes, Microsoft can theoretically compress the time to patch without sacrificing the human judgment needed to weigh deployment risk. However, the success of this approach depends on whether the human bottleneck actually narrows or merely shifts: if developers become overwhelmed by the volume of AI-generated findings and fixes, the benefit could be negated.

FAQ

Will AI make the final decision on security updates?: No. Microsoft stated that developers will still verify AI findings and make risk-based decisions about updates, and humans will remain in the loop when it comes to code review.
Why is Microsoft making this change now?: Hackers, even amateurs, have increasingly been using AI to quickly exploit security weaknesses over the past several months, and security researchers are also using AI to find issues faster, leading to more frequent high-severity vulnerabilities.

The Verge AIRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.