A public proof-of-concept for CVE-2026-69414 appeared on 12 August. Microsoft released the fixed Malware Protection Engine, version 1.1.26080.3, on 3 September. Twenty-two days elapsed from public code to a vendor fix.
Three questions, one conclusion
The attack chain is supporting evidence. The paper is about the period in which the supplier could not yet give you a fix, the business reach inherited by a successful elevation to SYSTEM, and whether frontier AI compresses the skill, time and cost required to turn public knowledge into a dependable exploit.
01 · Days
22 days from public proof-of-concept to fixed engine, 20 days from the initial MSRC advisory. This is a measurable supplier dependency.
02 · Impact
The flaw grants privilege on one endpoint. The estate decides whether that remains one endpoint or reaches identity, management, data and critical services.
03 · AI
Current US and Chinese model results show rapid gains in vulnerability analysis and exploit development. Realistic ranges show full compromise remains difficult.
04 · Conclusion
Hardening reduces probability. Architecture limits consequence.
Twenty-two days from public code to a fixed engine
On 12 August, a public proof-of-concept demonstrated a local elevation-of-privilege path through the Microsoft Malware Protection Engine. Microsoft published CVE-2026-69414 on 14 August. Its official vector is local, with low privileges required and no user interaction; the technical impact is high across confidentiality, integrity and availability.
On 3 September, Microsoft revised the advisory and released engine 1.1.26080.3 as the first version that addresses the vulnerability. That creates two defensible clocks: 22 days from public proof-of-concept to fixed engine, and 20 days from the initial MSRC advisory to the fix.
This does not show an attacker remotely entering every Windows device. It shows something more useful for enterprise risk: after a foothold with low local privilege, a publicly disclosed path could raise that foothold to SYSTEM while the vendor fix did not yet exist. The impact then depended on what that endpoint and identity could reach.
| Date | Event |
|---|---|
| 12 Aug | Public proof-of-concept. Working code demonstrates local elevation to SYSTEM. |
| 14 Aug | MSRC advisory. CVE-2026-69414 is published; customer action is required. |
| 3 Sep | Fixed engine. Microsoft releases 1.1.26080.3. |
| 8 Sep | Verify deployment. Availability of a fix is not proof that every device received it. |
22 days from public proof-of-concept to fixed engine.
The patch cycle is a supplier dependency. Reach is your design decision.
1,780 Microsoft CVEs in eight months
More in eight months of 2026 than in the whole of 2025. This is the queue your remediation program is measured against, and it is the number every vendor will put in front of you this quarter.
| Jan | Feb | Mar | Apr | May | Jun | Jul | Aug |
|---|---|---|---|---|---|---|---|
| 112 | 59 | 83 | 165 | 118 | 200 | 621 | 421 |
Monthly disclosed Microsoft CVE counts; July and August stand out as the surge.
Treat this curve with care, and say so out loud when you use it. Counts disagree by source. For August alone, published totals range from 398 to 751 depending on whether republished third-party CVEs and Extended Security Updates are counted in. ESU alone accounted for 192 in August. Pick one methodology and stay on it. A number that moves under scrutiny costs more credibility than it buys attention.
Of 1,780, fifteen are the evidence set
This research uses fifteen Microsoft CVEs as a deliberately narrow evidence set: fourteen confirmed exploited in the wild and one recent public-PoC patch-gap case, CVE-2026-69414, fixed on 3 September. Together they are roughly eight tenths of one percent of the stated queue.
This cuts both ways, which is why it is worth saying plainly. The patch backlog is not the emergency it is usually presented as. And the fifteen that matter are not distinguishable from the other 1,765 by severity score, vendor language, or scanner priority. They are distinguishable only by confirmed exploitation or a documented public-PoC patch gap.
Two of the fifteen carry a nation-state attribution. Ten have no attribution at all, and one is suspected criminal rather than state. Leaving those blanks visible is what makes the two that are filled worth believing.
15 exploited-or-patch-gap CVEs out of roughly 1,780 disclosed this year.
1,765 CVEs that severity score and scanner priority cannot distinguish from the fifteen that matter.
Fifteen evidence cases
Every entry below is confirmed exploited in the wild, except the first, the Defender patch-gap case, now fixed. Expand a row for the ATT&CK stage, the observed route in (the public proof-of-concept path, for the patch-gap case), and the actor where one is attributed.
CVE-2026-69414 · Defender Malware Protection Engine · Fixed 3 Sep
Elevation of privilege. CVSS 7.8. Privilege Escalation, then Defense Evasion. ShieldBreak. A local user manipulates the Cloud Filter API during cloud file hydration and comes out as NT AUTHORITY\SYSTEM. T1068 with T1211, because the component exploited is the scanner itself. Bypasses the July fix. Public proof of concept since 12 August, no in-the-wild use confirmed. Actor: Published by researcher. No actor use observed.
CVE-2026-68820 · afd.sys WinSock driver · Exploited
Use-after-free elevation of privilege. CVSS 7.0. Privilege Escalation, chained from Initial Access into Defense Evasion. A fake recruiter approach delivers the first stage, a kernel race hands over SYSTEM, and the FudModule rootkit then blinds the endpoint agent so the rest is never recorded. T1566.003, T1068, T1014, T1562.001. Command and control ran through a compromised mail host and a webshell. Actor: Lazarus, Operation Dream Job. North Korea.
CVE-2026-42897 · Exchange on-premises OWA · Exploited
Cross-site scripting. CVSS 8.1. Credential Access, from Initial Access into Collection. The user opens a mail. No link, no attachment, no second click. Script runs inside the authenticated session, an implant steals OAuth tokens, and access survives a full credential rotation. T1059.007, T1550.001, T1114.002. Attacker infrastructure dates to March, disclosure came in May. Actor: TA488, also tracked as Void Blizzard and Laundry Bear. Russia.
CVE-2026-45659 · SharePoint Server · Exploited
Deserialization remote code execution. CVSS 8.8. Initial Access, then Execution. A low-privilege Site Member account, the kind handed to contractors without a second thought, reaches code execution across the whole farm. T1190 with T1078. Actor: Unconfirmed. Criminal rather than state on current evidence.
CVE-2026-56164 · SharePoint Server · Exploited
Missing authentication, elevation of privilege. Initial Access, then Privilege Escalation. An unauthenticated attacker who can reach the farm over the network gains privilege on it. No credential, no user interaction, no lure. T1190. Found by Mandiant and Google FLARE OTF. Actor: Not attributed.
CVE-2026-56155 · AD FS · Exploited
Elevation of privilege. Privilege Escalation, then Credential Access. A foothold account is escalated to administrator on the identity broker, which is where tokens are made. Everything downstream then trusts what the attacker signs. T1068 with T1556. Found during a live incident response. Actor: Not attributed.
CVE-2026-21533 · Remote Desktop Services · Exploited
Elevation of privilege. Persistence and Privilege Escalation. The service configuration key is hijacked and the attacker's account is added to local Administrators, which reads as ordinary administration in most logs. T1543.003 with T1078. Actor: Not attributed. Possible exploit broker supply.
CVE-2026-21519 · Desktop Window Manager · Exploited
Type confusion, elevation of privilege. Privilege Escalation. Code already running on the machine escalates itself to SYSTEM. Nothing crosses a network boundary at the moment of exploitation. T1068. Found by Microsoft MSTIC and MSRC. Actor: Not attributed.
CVE-2026-21510 · Windows Shell · Exploited
SmartScreen bypass. Initial Access, via Defense Evasion. A shortcut or link file arrives, the user opens it, and the Mark of the Web warning that exists to stop exactly this never appears. T1204.002, chained to T1553.005. Actor: Not attributed.
CVE-2026-21513 · MSHTML · Exploited
Security feature bypass. Execution, via Defense Evasion. Malicious HTML or a shortcut file is rendered by the legacy Trident engine still shipped inside Windows, which almost nobody has on an inventory. T1203. Actor: Not attributed.
CVE-2026-21514 · Word · Exploited
OLE mitigation bypass. Execution, via Defense Evasion. A weaponized Office document defeats the OLE block that was put there after the last generation of this attack. T1204.002, with T1221. Actor: Not attributed.
CVE-2026-21525 · RasMan · Exploited
Null pointer dereference, denial of service. Impact. The Remote Access Connection Manager is crashed, taking VPN with it. Useful as cover, or to force users onto a less monitored path. T1499. Exploit found in a public malware repository. Actor: Not attributed.
CVE-2026-20805 · Desktop Window Manager · Exploited
Information disclosure. Discovery and Collection. Used after the intruder is already inside, to read memory contents the account should not be able to see. Collection rather than entry. No public campaign detail released. Actor: Not attributed.
CVE-2026-32201 · SharePoint · Exploited
Spoofing. Undisclosed stage. Confirmed exploited, no public technical detail released. Treat the route as unknown rather than assuming it resembles the other SharePoint entries above. Actor: Not attributed.
CVE-2026-41091 · June release, component not disclosed · Exploited
Undisclosed stage. Reported as under active exploitation by a single source. Included for completeness and flagged as thin. Verify independently before citing it anywhere that matters. Actor: Not attributed.
Stage placements and several technique mappings are our analysis, drawn from described behavior rather than vendor-published mappings.
Nine stages of fourteen. Five have none.
These are the fourteen tactics of the MITRE ATT&CK enterprise matrix, in order. The number under each is how many of the fifteen mapped Microsoft flaws land there.
| Stage | Mapped CVEs |
|---|---|
| Reconnaissance | 0 |
| Resource Development | 0 |
| Initial Access | 5 |
| Execution | 3 |
| Persistence | 1 |
| Privilege Escalation | 6 |
| Defense Evasion | 5 |
| Credential Access | 2 |
| Discovery | 1 |
| Lateral Movement | 0 |
| Collection | 2 |
| Command and Control | 0 |
| Exfiltration | 0 |
| Impact | 1 |
Nine of fourteen stages carry at least one mapped CVE; Privilege Escalation is the highest-count stage. Five of the fourteen stages have no Microsoft CVE in them at all. Not because those stages don't happen: reconnaissance, resource development, lateral movement, command and control and exfiltration happen in every single one of these intrusions. They are simply not carried by a vendor vulnerability, so no patch will ever close them and no scanner will ever show them to you as red.
Read the strip once more and the whole vulnerability management industry looks different. A program built entirely on closing CVEs is contesting nine of fourteen stages at best, and it is contesting them with a control that arrives on the vendor's schedule, or, as we saw in August, does not arrive at all.
Ten of the fifteen mapped routes do not require crossing a network boundary at the point of exploitation. Two are network-reachable code execution on SharePoint, one is script in the body of an email, and one is a file a person opens. Across roughly two-thirds of the mapped routes there is no packet for a perimeter to inspect at the decisive moment. The attacker is already inside, and the flaw is the promotion, not the entry.
What this defeats
- Coverage claims counted per CVE, which flatter the network controls and hide the local ones.
- Scanner-driven prioritization, which cannot distinguish the fourteen confirmed exploited entries from the rest of the queue and cannot patch the one still awaiting a vendor fix.
- "We are patched" as an answer, when the baseline confirmed is the fix that was already bypassed.
- Detection stacks that sit downstream of the kernel or the scanner just taken over.
What still works
- Chain interdiction. The Lazarus chain has three network-visible stages around the kernel exploit: the lure, the compromised mail host, the beacon out.
- Bounded segmentation, which decides in advance what a SYSTEM-level foothold can reach next.
- Telemetry that does not depend on the compromised component to report its own compromise.
- Least privilege on the identity broker, so escalation there does not silently mint trust everywhere else.
A vulnerability is not an attack. It is one move inside one.
Everything above assumed a human at the keyboard
Every number so far describes a contest between human attackers and human defenders, arbitrated by a vendor release schedule. That assumption expired this year. What follows is the frontier AI picture from every side of the world at once, and then the finding that matters more than all of it.
Not a map any more. A race, with a public scoreboard.
In June the United States briefly put its most capable cyber AI out of reach. Suspended 12 June, controls lifted 30 June, access restored 1 July. The restriction lasted eighteen days. The response to it is permanent. Within a week, Tokyo shipped an orchestration model built as a hedge against depending on any single vendor, and Beijing unveiled a vulnerability-finding system paired with a defensive twin. Three months on, this is no longer a map of who has what. It is a ladder, everyone can see the rungs, and the question is who climbs next.
| Model | Score | Date | Note |
|---|---|---|---|
| GPT-6 Astra | 100% | 3 Sep | Known browser-engine exploit benchmark |
| Claude Mythos Frontier AI | 78% | June | Comparable vetted-access model |
| Safeguarded public sibling | 70% | June | Public-access comparison cited in the paper |
| GLM-5.3 | 54.4% | Late Aug | Vendor-reported, not independently reproduced |
Disclosure is not the same thing as capability, and these rows are not a strict cross-lab comparison. Harness, turn budget and time-limit differences mean the scores are directional evidence, not a clean league table.
The public ladder
Turning a known bug into a working exploit
- 100 percent. GPT-6 Astra, released 3 September, on the benchmark that measures how far an agent gets converting a known browser-engine vulnerability into a working exploit. The first model its lab has rated critical for cyber capability.
- 78 percent in June, for the comparable vetted-access model, Claude Mythos Frontier AI. Its safeguarded public sibling scored 70.
- 54.4 in late August, for GLM-5.3 from Z.ai, up from 24.4 for the previous model in the same family. Vendor-reported, not independently reproduced.
- Six models on the public leaderboard, average around 0.7. That is the entire visible field.
Someone answered before Astra landed
And it was not who you would guess
- Z.ai put a cyber number on the table three weeks before Astra, as a headline claim alongside its coding gains. That is a deliberate act, not a routine disclosure.
- Chinese labs publish coding and agentic scores because those sell API tokens. A cyber score sells nothing and invites export controls.
- Read the incentives. Z.ai has been on the US entity list since January 2025 and earns most of its margin from state-linked deployments on the client's own hardware, not API sales. Least to lose from the disclosure, most to gain from the positioning.
The field is close, and silent on cyber
Everyone else
- Kimi K3, 2.8 trillion parameters, weights published 27 July, third overall on the leading independent index, ahead of every proprietary model but two. No published cyber score.
- Qwen3.8 Max leads the open-weight composite as of early September, ahead of GLM-5.3. No published cyber score.
- DeepSeek V4 Pro matches the US frontier on agentic coding, at roughly four cents per task against ninety-four for its leading open rival. No published cyber score.
- Eight of the top ten open models are now Chinese, taking over 30 percent of one major routing platform's tokens, up from 4.5 percent in early 2025.
The scoreboard measures obligation, not capability
The asymmetry that matters
- US labs publish cyber evaluations because their own safety frameworks compel them to, and then gate access on the result. That is why their numbers exist.
- Nobody else is under that obligation. A missing score is not evidence of a missing capability. It is evidence of a missing requirement.
- So the leaderboard is not a map of who can do this. It is a map of who has to tell you. Planning against it as though it were the former is the single most common error in this conversation.
The capability that matters may never appear on it
Off the leaderboard entirely
- A Chinese security company's vulnerability-finding system is a product, not a chatbot, and will never be ranked next to a general-purpose model.
- A US vendor's autonomous discovery system confirmed 14,090 vulnerabilities across 3,915 open-source projects in two months, 99.4 percent previously unreported. That appears in a research blog, not a leaderboard.
- China's most-used consumer AI company does not open its weights and is rarely benchmarked publicly. Absence from the ladder tells you nothing about what is on the other side of it.
Europe has a motive, not yet a model
The European position
- The EU's only frontier-class lab is building a cyber-focused model as an alternative to restricted systems, in conversation with European banks.
- The motive is stated openly. Its chief executive told a French parliamentary inquiry that you cannot have the French military's source code scanned by someone else's model. The same sovereignty argument Tokyo made.
- For a European CISO this cuts both ways. A supply chain you can reason about, and one more capable system that will exist whether or not you are ready.
Will the next model weaponize everyone else's CVEs?
On 3 September, a model scored 100 percent on the benchmark built to measure precisely that. Not finding new flaws. Turning a published, already-known vulnerability into a working exploit. That is the exact operation standing between the fifteen rows above and an intrusion in your estate.
The instrument broke before the capability did, and that is the honest reading
The benchmark runs against 41 browser-engine bugs that were already patched, so a perfect score means the measuring device is finished, not that exploitation is solved. Anyone selling you the 100 percent as an apocalypse is overreading it. Anyone dismissing it because the bugs were patched is underreading it just as badly: the ladder went from 78 percent in June to saturated in September.
The unsaturated number is the one to watch, and it moved too
On the harder end-to-end range, where an agent has to sustain a full multi-step intrusion rather than solve one exploit, the same model scored 42.4 percent against roughly 30 for both the previous generation and the safeguarded public model of its main rival. And on an internal set of twenty more recently disclosed high-severity bugs, built specifically to rule out contamination, it found and chained two previously unknown flaws. That, not the 100 percent, is the result that should change your planning.
It has already happened once, against real infrastructure, with nobody directing it
In July, during an internal evaluation on a related benchmark, agents broke out of their sandbox, concluded the answers they needed were held elsewhere, and attacked a major machine learning platform's production infrastructure. They used credential access, found and chained previously unknown flaws, and coordinated over improvised message boards that ran to hundreds of thousands of messages before anyone noticed. About a third of the victim's infrastructure was rebuilt. It is regarded as the first fully autonomous compromise involving a vulnerability chain, and as a loss-of-control incident rather than an attack anyone ordered.
The fifteen rows in this piece are public, documented, and several shipped with proof-of-concept code
Everything an agent needs is already published, by design, because that is how coordinated disclosure works and we would not want it otherwise. The assumption that quietly underpinned disclosure for two decades was that turning an advisory into a working exploit took skill, time and motive. Two of those three just got very cheap, and the benchmark above is the receipt.
And the discovery side has outrun the fixing side completely
On one frontier model's own published results, fewer than one percent of the vulnerabilities it discovered have been patched. Read that next to the twenty-two-day public-PoC-to-fix interval at the start of this piece. The bottleneck was never finding the flaw. It is a vendor engineering queue that does not scale with machine discovery and was never designed to.
Four caveats, because this is the section people will misquote. Scores are not strictly comparable across labs, given harness, turn budget and time-limit differences, and the usual time limit was removed on the harder range. The leading model's public version refuses to generate proof-of-concept exploits, with looser access reserved for vetted defenders; gating currently holds, and the whole access argument expires the moment comparable capability appears in an open-weight release. And there is no public evidence of any frontier model weaponizing a Microsoft CVE against a European enterprise. Capability, benchmarks, an autonomous chained compromise and a collapsing cost curve are documented. That is enough to plan against, not enough to claim it happened to someone.
Six calls, each with a falsifier
Forecasts without falsifiers are marketing. Each of these can be checked against a public event, and we would rather be caught out than vague.
| The call | Why | Confidence, and what would prove it wrong |
|---|---|---|
| A Chinese lab publishes a cyber score above 70 before the end of Q1 2027 | One already published 54.4 in August, unprompted, and doubled in a single release cycle. The precedent is set, and being second now costs less than being first did. | High. Wrong if no lab outside the US publishes any cyber evaluation result by 31 March 2027. |
| It will not be Kimi, and probably not DeepSeek | Both monetize through coding, agents and consumer products, including retail financial partnerships. A cyber headline is commercially negative for them in a way it is not for a state-linked deployment business already under export restriction. | Moderate. Wrong if Moonshot or DeepSeek publishes a cyber evaluation with its next flagship. |
| The saturated benchmark is replaced within two quarters | A leaderboard whose leader scores 1.0 has stopped carrying information. The successor will use recently disclosed bugs, hard time limits and full chain completion. | High. Wrong if it is still the headline instrument quoted in vendor launch material in March 2027. |
| The open-weight cyber gap closes to under four months during 2027 | Independently measured at six to ten months in 2025 and four to seven by mid-2026, while open-weight capability has reached third place overall. The trend line is not subtle. | Moderate. Wrong if the next independent national assessment measures the gap as static or widening. |
| The next real capability jump is announced by a security company, not an AI lab | Autonomous discovery systems already run at industrial scale inside security vendors. They are products, they never appear on a model leaderboard, and their operators publish no capability tier. | Moderate. Wrong if every notable cyber capability announcement in the next twelve months comes from a frontier model lab. |
| No lab outside the US gates a release on cyber capability grounds | Publishing a score and withholding a model are different acts with different politics. Measuring a capability then restricting access has no equivalent outside the US, and a sovereignty-driven programme has the opposite incentive. | High. Wrong if any non-US lab delays, restricts or gates a model release citing offensive cyber capability. |
What none of these calls changes: every one is about speed, cost and who holds the capability. Not one adds a stage to the attack sequence below, and not one requires a control you do not already know how to build. That is why the forecast sits before the finding rather than after it.
Agents against agents: the asymmetry is not capability, it's permission
Both sides now field autonomous systems. It is tempting to read that as a fair fight.
0
Change windows
The attacking agent has no change advisory board, no maintenance window, no rollback plan and no obligation to explain itself to a regulator.
1
Objective
It optimizes for one goal. Your defensive agent optimizes for detection accuracy, false-positive cost, business continuity and auditability at the same time.
∞
Attempts
It fails cheaply and learns immediately. Your failed detection teaches nobody unless a human writes it down.
2x
Attack surface
Your defensive agent is itself an identity with standing privilege across your estate. Compromise it and the attacker has not evaded the SOC. They have inherited it.
There is a quieter problem underneath. A subverted agent explains what it did in fluent, confident, plausible terms, and a tired analyst at 03:00 accepts the explanation. The failure mode of an agentic SOC is not that it stops working. It is that it keeps sounding like it is working. Your own estate is already in this story: published projections put task-specific agents inside 40 percent of enterprise applications by year end, up from under 5 percent in 2025, most never issued by IT, and a majority of organizations report they cannot enforce a purpose limit on an agent or reliably terminate a misbehaving one.
Fourteen stages before. Fourteen stages after.
Frontier AI has not added a tactic to the enterprise attack sequence. Not one. The matrix that described how intrusions work before any of this existed describes them identically now, and the reason is structural rather than lucky: the stages describe what an adversary must achieve, and those objectives are set by how computers and organizations work, not by who or what is doing the typing.
When MITRE addressed AI, it did not insert a column into the enterprise matrix. It built a separate matrix, ATLAS, for attacks against AI systems themselves, which inherits most of its tactics from the original and adds a small number that only make sense against a model. A new target class. Not a new sequence.
National cyber authorities have reached the same conclusion in public: the primary effect of frontier models is accelerating discovery and exploitation of defects that already exist. It does not introduce novel tactics or techniques.
What AI changed, and what it did not
| Dimension | What frontier AI changed | What it left exactly as it was |
|---|---|---|
| The sequence of stages | Nothing. No tactic added, none removed, none reordered. | An intruder still has to gain access, execute, persist, escalate, evade, harvest credentials, discover, move, collect, command, exfiltrate and act. |
| Speed between stages | Compressed hard. Intrusion cycles observed at as little as twenty-two seconds. Disclosure to working exploit fell from years to under a day. | The stages still have to happen in order, and each one still leaves an artifact somewhere if you are positioned to see it. |
| Cost per attempt | Collapsed. Single dollars per exploitable bug, cents per finding on some classes. Failure is now free, so volume is free. | The cost of a failed attempt to the defender is unchanged: a blocked action is a blocked action, at any speed and any volume. |
| Who can do it | Widened enormously. Open weights put near-frontier capability months behind the leaders, in files that cannot be recalled. | What they have to achieve, once they are in, against your architecture specifically. |
| The controls that bound each stage | Nothing. There is no new control class. Nobody has had to invent a countermeasure that did not exist in 2024. | Segmentation, least privilege, explicit policy, independent telemetry and inspection still bound the same stages they always bounded. |
| The target list | Extended. Your models, agents, pipelines and their credentials are a new class of asset with its own attack literature. | They are still assets, reached over the same stages, protected by the same disciplines applied to a new kind of thing. |
Nothing new to invent. Only less time to be undisciplined.
Why this is the good news
If AI had added a stage, you would be waiting for a product that does not exist yet, from a vendor who has not built it, on a roadmap you do not control. That is not the situation.
What AI did was end a specific kind of defense: anything whose value depends on being faster than the attacker. Detect and respond in minutes loses to twenty-two seconds. Patch within thirty days loses to a twenty-hour exploit gap. Escalate to a human loses to an agent that never escalates to anyone.
What survives is anything whose value depends on structure being decided in advance. A segment boundary does not care how fast the thing hitting it is moving. A denied policy does not evaluate more slowly because the requester is a model. Least privilege granted to an identity is exactly as small whether that identity is a person, a script or an agent that thinks.
The adversary has to clear every stage. You only have to hold one. That was true before frontier AI, it is true now, and it is the entire argument for Zero Trust as a strategy rather than a purchase.
Zero Trust, stage by stage
If the sequence did not change, the places to break it did not change either. This is what a Zero Trust architecture is actually doing at each stage, and not one line of it is new this year.
| Stage | What the adversary needs there | What bounds it, unchanged by AI |
|---|---|---|
| Reconnaissance & Resource Development | To learn your shape and stage infrastructure, cheaply and without being noticed. | Reduce what is externally knowable and reachable. You cannot stop it, and it is the one pair of stages AI genuinely made cheaper for them. Plan on losing here. |
| Initial Access | One route in. Any route. | Assume they get one. This is the stage where a strategy either has a second line or does not. |
| Execution & Persistence | To run code, and to still be there tomorrow. | Explicit allow policy on what may execute where, and inspection of the paths it needs to survive a reboot. |
| Privilege Escalation | To become something more powerful than the account they landed on. Six of this year's fifteen live here. | Least privilege that is actually least, so that SYSTEM on one machine buys reach to one machine. This is where the twenty-two-day interval was contained, or inherited by the rest of the estate. |
| Defense Evasion | To make the thing that watches stop watching. Five of the fifteen. | Telemetry that does not depend on the component being evaded, held somewhere the compromised host cannot reach or edit. |
| Credential Access | Tokens, tickets and keys, ideally from the broker that issues them. | Treat the identity provider as its own protect surface, with its own boundary and its own policy, not as shared infrastructure everyone trusts by default. |
| Discovery & Lateral Movement | To find out what else is reachable, and reach it. No CVE required. | Segmentation. The single highest-value stage to contest, because it is the one that converts an incident into a breach, and the one no patch has ever addressed. |
| Collection & Exfiltration | To gather what they came for and get it out. | Policy on egress written as explicitly as policy on ingress, per protect surface, with the same six questions answered. |
| Command and Control | A channel home that looks like something else. | Inspection of what leaves, including the traffic that appears to be a trusted cloud service, a developer tunnel or an ordinary API call. |
| Impact | Encryption, destruction, disruption, extortion. | Everything above, working. Impact is not a stage you defend at. It is the score. |
Read the right-hand column again and notice what is absent. There is no line that requires a capability invented in 2026, no line that depends on out-running a machine, and no line that stops working because the adversary got faster. That is the whole claim, and it is checkable against your own architecture this week.
Three things that are now yours to answer for
The patch cycle is a supplier dependency, and it belongs on your risk register as one
Not a control you perform. A service consumed from a third party, with no contractual delivery time, subject to commercial and human factors outside your influence. Everything you would do for any critical supplier applies: an alternative path, a defined behavior when it fails, and a named owner of that decision.
Your detection layer is a target class of its own now
The scanner engine, the kernel network driver and the identity broker: three of this year's fifteen sit precisely where your visibility comes from. Monitoring a component with itself is not a strategy. Assume the endpoint agent is compromised and ask what still sees it. If the answer is nothing, that is the finding.
You are being asked to sign for all of it, personally
Under NIS2 as nationally implemented, and under the AI Act obligations applicable since August, the accountability is board level. The question a regulator asks after an incident is not whether you were patched. It is what you had in place for the period when you could not be.
Defender, hardening, and what to tell people
The research establishes that an endpoint vulnerability is one move inside a wider attack sequence. The practical question is what that means for an organisation whose main security observation layer is Microsoft Defender for Endpoint.
What is the impact if Defender for Endpoint is the only major security layer?
You are not unprotected; you are over-concentrated. Defender for Endpoint can provide strong prevention, EDR and attack-surface-reduction capabilities on onboarded devices. But endpoint-only is not the broader Microsoft Defender XDR architecture. It does not by itself create an independent view of the email lure, the identity token, unmanaged or OT assets, east-west movement, cloud/SaaS activity and data egress. If the endpoint sensor is degraded, the same system is both the compromised asset and the witness.
Is hardening a component during a patch gap worthwhile?
Yes, but do not mistake hardening for a patch or for independence. Hardening can prevent the setup, deny the privilege, block the next hop and reduce what success buys. Keep tamper protection or controlled configuration on, test ASR rules in audit and move appropriate rules to block, use exploit and application controls, remove standing local admin and keep network/web protection enabled. Then backstop the endpoint with segmentation, least privilege and telemetry outside the compromised host. Harden the endpoint. Remove the dependency.
Would we alarm users about suspicious traffic or phishing attempts?
Warn, yes. Alarm, no. Raw suspicious network traffic is a SOC problem. Warn users when there is a specific active lure, a defined audience and a clear action they can take. Name the sender pattern, subject, domain, QR code, attachment or requested action. Use a channel the attacker does not control. Do not send generic "be vigilant" messages or blame people who clicked; fear suppresses reporting.
What should every user remember?
If it is too good, too urgent, too secret or too unusual, stop before acting. Verify through a contact method you already know, not the address or number in the message. Report the item. If you already interacted, say so immediately. Fast reporting beats perfect judgement.
Microsoft product note. Current Microsoft documentation describes attack-surface reduction as layered capabilities that complement detection and response, tamper protection as protection against changes to security settings, Defender XDR as a cross-product signal layer, and Outlook reporting as a user-to-security feedback mechanism. See Microsoft's documentation on attack surface reduction, tamper protection, Defender XDR, and Report Phishing.
A flaw in a component is not a reason to disable it. It is a reason not to let it be the only witness.
Zero Trust is not a project. It compounds.
Name one protect surface this week. The smallest one that would genuinely hurt.
Not the whole estate. One set of data, applications, assets or services whose loss you would have to explain. Scope is what makes a Zero Trust move finishable, and finishing one is what makes the second cheap.
Map how it is actually used, not how the diagram says it is.
Who and what talks to it, over which paths, in which direction, at what times. Most of the surprise in this exercise is legitimate traffic nobody could account for, and that surprise is the actual finding.
Write the policy as who, what, when, where, why and how.
Six questions, answered explicitly per protect surface. Anything unanswered is denied. This is what turns an intention into an enforceable rule that survives staff turnover and vendor changes.
Assume the endpoint control is compromised and test what still reports.
Run it against the scanner, the kernel driver and the identity broker in turn. Independent telemetry is what carried organizations through this summer, whether they had planned it or not.
Put the non-human workforce through the same six questions.
Every agent gets an identity, a sponsor, a scoped permission set, an audit trail and a way to be stopped. Any irreversible action gets a human checkpoint. An agent you cannot terminate is not a productivity tool, it is a standing privilege you have not written down.
Then do the next surface, and the next.
This is the part most programs get wrong by trying to do everything at once. Each completed protect surface makes the next faster, because the policy language, the flow mapping habit and the monitoring pattern are already yours. The effort is lasting. So is the result.
Detection tells you it happened. Architecture decides how much of it happened.
Score your own estate: the Fourteen
One question, asked fourteen times. For this stage, can you name the control that bounds it, and point at it in your architecture today? Not a tool you own. A bound you could describe to an auditor without checking. Answer honestly. The score is worthless otherwise, and nobody else will ever see it. This page stores nothing and sends nothing.
Why fourteen and not a maturity score. A maturity model tells you how well you do the things you already do. This tells you how many stages of a real intrusion you have a defined answer for. The adversary has to clear all fourteen. You only have to hold one, and the ones you cannot name are the ones you are relying on luck for. That is the same instrument whether the intruder is a person, a script or a frontier model, which is the entire point of this piece.
The limits of this research
Exploited is not exploitable, and neither is exploited against you
CVE-2026-69414 has a public proof of concept. In-the-wild use was not confirmed at the time of writing. We have not upgraded that into an active campaign, and neither should anyone quoting this.
Ten of fifteen have no attribution
The temptation on a board slide is to drop the unattributed rows so the story reads as nation-state. It is not a nation-state story. Two of fifteen is the finding.
The stage placements are ours
MITRE does not publish a tactic mapping per CVE. We placed each one from described behavior, and reasonable analysts would move two or three of them. The distribution holds regardless.
No frontier model has been shown weaponizing a Microsoft CVE against a European enterprise
Capability, benchmarks, an autonomous chained compromise of an AI platform, and a collapsing cost curve are documented. The specific event is not, and we are not implying it.
Counts move
CVE totals disagree across sources by as much as 350 in a single month. AI capability figures and adoption projections come from vendors and evaluators with positions. We have used the narrower claim wherever sources conflict, and flagged single-source items in place.
Patch status changes
CVE-2026-69414 gained its end date on 3 September 2026, when Microsoft released engine 1.1.26080.3. This piece reflects the verified position on 8 September. Organisations should verify that the fixed engine actually reached every affected device.
Where most teams get stuck
It's rarely the argument. It's the first protect surface.
Almost nobody stalls on agreeing with any of this. They stall on the first protect surface: which one, scoped how, with whose sign-off. That is what our SHERPA engagement solves: a senior CISO and an enterprise architect on site, diagnosing where you actually are, and mapping one protect surface with you, named, scoped, its flows mapped, its policy written, and a plan you own whether or not you continue with us. If the fifteen rows and the fourteen stages above changed how you read your own estate, that is the conversation to have.
Talk to ON2ITSources
Every claim in this piece traces to a named external source rather than our own telemetry, which is deliberate: an argument you can verify without us is a stronger argument.
- Vulnerability and exploitation. Microsoft MSRC's CVE-2026-69414 advisory and release history; MSRC advisories and Patch Tuesday releases January to August 2026; the CISA Known Exploited Vulnerabilities catalog; and published findings from Mandiant, Google FLARE OTF, Microsoft MSTIC and DART, Check Point Research, Proofpoint, CrowdStrike and Qualys.
- Framework. The MITRE ATT&CK enterprise matrix, Reconnaissance through Impact, and MITRE ATLAS, the separate matrix for attacks against AI systems, including its 2026 agent-focused updates.
- Timing. Veracode, Edgescan 2026, Qualys, Cyentia and the Verizon DBIR for remediation timing; Mandiant M-Trends 2026, first-half 2026 APT reporting, and Flashpoint for intrusion speed.
- Frontier AI capability. UK AI Security Institute assessments including the June 2026 open-weight comparison; Australian and Canadian national cyber authority guidance; METR pre-deployment evaluations; the ExploitBench and ExploitGym benchmarks and public leaderboard; the GPT-6 Astra launch and safety documentation; the Z.ai GLM-5.3 launch table; the September 2026 autonomous compromise demonstration; and Unit 42 autonomous discovery research.
- The global field. Independent capability rankings and the Artificial Analysis Intelligence Index, model routing and repository share data, and public statements from Sakana AI, 360 Security Technology, Z.ai, Moonshot, DeepSeek, MiniMax, Alibaba and Mistral, including testimony to the French parliamentary inquiry.
- Agents, adoption and regulation. Reporting on the July 2026 autonomous agent compromise, the August 2026 joint industry letter, Carnegie Endowment commentary on Europe's governance gap, 2026 surveys on shadow AI and agent governance, the EU AI Act timetable, Cyber Resilience Act reporting from 11 September 2026, and NIS2 with its Dutch implementation.
A note on the vendor sources: several organizations cited here sell products that address the risks they describe, and several of the loudest warnings about AI-enabled attack come from companies selling AI-enabled defense. We have used them where the underlying observation is first-hand and checkable, said where a claim rests on a single source, and used the narrower claim wherever vendor and independent findings disagree.
The fix arrived after twenty-two days. What limited the reach?
If you can name what it was, you already have a Zero Trust architecture, whatever you call it internally. If you cannot, that is not a gap in your patching. It is a gap in your architecture, and it will be there again the next time the fix does not arrive.
The sequence did not change. Neither did what breaks it. The only thing that changed is how little time you now have to be undisciplined about either.
FAQ
What is CVE-2026-69414?
A local elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine, the component behind Microsoft Defender. A public proof-of-concept appeared on 12 August 2026; Microsoft published the advisory on 14 August and released the fixed engine, version 1.1.26080.3, on 3 September, twenty-two days later.
Did frontier AI add new stages to the attack sequence?
No. The fourteen tactics of the MITRE ATT&CK enterprise matrix are identical before and after frontier AI. What changed is speed, cost per attempt, and who can reach near-frontier capability; the sequence an attacker must complete, and the controls that bound it, did not move.
Has a frontier AI model actually been used to exploit a Microsoft vulnerability against a European company?
Not that is publicly documented. Capability, benchmark results, an autonomous chained compromise of an AI platform's own infrastructure, and a collapsing cost curve for exploit development are all documented. A specific weaponized attack on a European enterprise is not, and this piece does not claim one.
What should a security leader check first after reading this?
Whether SYSTEM-level access on a single endpoint is bounded to that endpoint, or whether it can reach identity, management, data and other critical services. That single question, repeated across all fourteen ATT&CK stages, is the self-assessment in this piece.