Microsoft's 2026 Digital Defense Report argues attackers are currently benefiting from artificial intelligence faster than defenders and that the world faces a multi-year spike in known-but-unpatched vulnerabilities. The report says AI is cutting the time, expertise and cost needed to discover and exploit flaws while remediation stays inherently slower — many systems lack the testing to deploy changes rapidly — and warns the median time from in-the-wild vulnerability discovery to weaponisation has fallen well below 24 hours; well-funded adversaries may stockpile AI-discovered zero-days. It documents nation-state AI use in real operations: Chinese actors using AI tools for vulnerability research, Russian actors using "vibe coding" to speed tooling, and North Korean IT workers and malware developers using AI for persona development and attack infrastructure. Microsoft qualifies the picture — most observed campaigns still retain human direction, even as frontier systems demonstrate end-to-end autonomy in labs and early real-world cases.

• Source article