Security Now · 2026-05-20 · 2h 52m
Key moments - from our scoring
Substance score
18 / 100
Five dimensions, 20 points each
Microsoft's Codename EM Dash marks a turning point in how critical vulnerabilities are discovered and remediated. Rather than relying on traditional human security researchers or single AI models, EM Dash orchestrates a multi-agent AI approach where over 100 specialized agents work collaboratively - analyzing code, challenging findings, debating potential vulnerabilities, and attempting actual exploitation. The system recently discovered 16 brand-new flaws within Windows' networking and authentication stack, four of which represented remote code execution risks that could allow attackers to gain system access without user interaction. These findings were validated and patched during the most recent Patch Tuesday cycle, demonstrating real-world operational impact. Built on expertise from DARPA AI Cyber Challenge winners, EM Dash's architecture is theoretically portable across any advanced language model, suggesting the approach could reshape industry-wide security practices. The system's ability to minimize false positives through agent-based debate reduces alert fatigue while increasing confidence in critical findings. For B2B operators managing Windows infrastructure and security teams evaluating vulnerability detection tools, this episode explains how agentic AI is outpacing traditional security methods and what this means for patch cycles and breach prevention.
EM Dash is an AI-powered security auditing system that orchestrates over 100 specialized AI agents to analyze code, debate findings, validate vulnerabilities, and attempt exploitation. Unlike traditional methods relying on human researchers or single AI models, this multi-agent approach dramatically increases speed, accuracy, and depth of vulnerability detection while reducing false positives.
EM Dash discovered 16 brand-new vulnerabilities in Windows networking and authentication code, including four remote code execution flaws that could allow attackers to compromise systems over the internet without any user action. These findings were patched in the most recent Patch Tuesday release.
Yes, EM Dash's design allows it to work with any advanced language model, making it theoretically deployable across the industry rather than being restricted to Microsoft's internal use.
EM Dash's success suggests AI-driven security could shift cybersecurity from reactive patching after vulnerabilities are discovered to proactive detection before code reaches production, potentially eliminating traditional Patch Tuesday cycles and making software safer by design.
The multi-agent system allows AI agents to specialize, collaborate, debate findings with each other, and validate real-world exploitability, which reduces noise from false positives while highlighting only the most actionable threats with higher confidence than single-method detection.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode content provided is almost entirely promotional summary and abstraction with minimal concrete technical insight. There are no deep technical explanations of how EM Dash actually works, no discussion of false positive rates, architecture trade-offs, or implementation details that would educate a security operator. The transcript reads as marketing copy rather than substantive technical discussion.
EM Dash uses a multi-agent approach - meaning it orchestrates more than 100 specialized AI components, each designed to review, debate, validate, and even attempt to exploit potential bugs in code.
different AI agents specialize, collaborate, and even argue with each other to challenge findings, weed out false positives, and prove real-world exploitability.
The framing of AI-driven security as a game-changer is entirely standard industry discourse. There is no contrarian perspective, no first-principles challenge to the EM Dash narrative, and no discussion of limitations or potential downsides. The content simply amplifies Microsoft's own claims without critical examination or novel angles.
AI-driven security has moved from research to reality.
This marks a turning point for cyber defense, as AI now matches or exceeds expert-level vulnerability research at speed and scale.
The transcript does not identify any actual guest. It references only that 'Gibson explained' but provides no credential, title, or substantive background. The content is primarily summary and marketing language with no evidence of a real practitioner or operator being interviewed at depth.
Gibson explained that EM Dash was able to find 16 brand-new vulnerabilities within Windows' networking and authentication code
On Security Now, Gibson explained
While the transcript mentions some specific numbers (16 vulnerabilities, 100+ AI agents, 4 RCE flaws, reference to DARPA AI Cyber Challenge), it provides almost no concrete data, no named examples of the actual vulnerabilities, no metrics on false positive reduction, no actual code snippets, and no detailed case studies. Claims are asserted but rarely evidenced.
EM Dash was able to find 16 brand-new vulnerabilities within Windows' networking and authentication code, including four that could have led to remote code execution
Microsoft built EM Dash on the foundation of expertise from winners of the DARPA AI Cyber Challenge
This is not a podcast transcript at all - it is a written summary or promotional article with no dialogue, no host questions, no guest responses, and no conversational back-and-forth. There is no evidence of journalistic push-back, follow-up questions, or any form of genuine interview. It reads as canned marketing copy.
How Microsoft's Codename EM Dash Outsmarts Security Threats
The Bottom Line Microsoft's unveiling of Codename EM Dash demonstrates that agentic AI is not just theoretical
Computed from the transcript - who did the talking, and the words that came up most.
OpenAI, Microsoft, and Google are racing to unleash next-gen AI that hunts for software vulnerabilities and hacks at scale. This episode explores how these advancements could shake up everything we thought we knew about cybersecurity. Microsoft rethinks Edge's "intended behavior" after it gets press. Chaotic Eclipse hacker strikes again with a Bitlocker bypass. Google's threat analysis group documents malicious AI use. Canada hasn't learned the lessons of the EU and the UK. AI chatbots may be far more addictive than social media. Project: Hail Mary now available to stream. An apparently-serious zero-point quantum vacuum energy source. A bit of listener feedback. OpenAI's & Microsoft's vulnerability discovery systems Show Notes - Hosts: Steve Gibson and Leo Laporte Download or
Transcribed and scored by The B2B Podcast Index.
AI Finds the Bugs Humans Miss: Microsoft’s Codename EM Dash Sets a New Benchmark in Software Security Primary Navigation Podcasts Club Blog Subscribe Sponsors More… Tech AI Finds the Bugs Humans Miss: Microsoft’s Codename EM Dash Sets a New Benchmark in Software Security May 20th 2026 AI-generated, human-reviewed. On this week’s episode of Security Now , the spotlight was on Microsoft’s Codename EM Dash - a cutting-edge AI-powered system that just uncovered some of the most critical vulnerabilities in Windows history.
This marks a significant leap in how software is protected, revealing that artificial intelligence isn’t just a buzzword but an essential tool propelling cyber defense into a new age. How Microsoft’s Codename EM Dash Outsmarts Security Threats EM Dash is Microsoft’s newly revealed internal tool for security auditing. Unlike previous methods that depended mainly on human researchers or single AI models, EM Dash uses a multi-agent approach - meaning it orchestrates more than 100 specialized AI components, each designed to review, debate, validate, and even attempt to exploit potential bugs in code.
This ensemble method dramatically increases not just the speed but also the accuracy and depth of vulnerability detection. On Security Now , Gibson explained that EM Dash was able to find 16 brand-new vulnerabilities within Windows’ networking and authentication code, including four that could have led to remote code execution - the kind of bug that attackers can exploit over the internet without any user action. These discoveries were not only theoretical; Microsoft issued fixes for these high-stakes issues during the most recent Patch Tuesday.
Why EM Dash Is a Security Game-Changer Traditional software security relies on human experts and automated tools flagging patterns known from past vulnerabilities. What sets EM Dash apart is its agentic system: different AI agents specialize, collaborate, and even argue with each other to challenge findings, weed out false positives, and prove real-world exploitability. This reduces noise (unnecessary alerts) and highlights only the most actionable threats. Microsoft built EM Dash on the foundation of expertise from winners of the DARPA AI Cyber Challenge, combining top-tier academic knowledge with real-world, production-scale software systems.
The system isn’t restricted to Microsoft in principle - the design allows it to work with any advanced language model, meaning this approach could be adopted across the industry. What This Means for the Future of Software Security According to Security Now , EM Dash’s success shows that AI-driven security has moved from research to reality . This advance could dramatically shrink the window of vulnerability for new bugs, potentially making major Patch Tuesday releases a thing of the past.
With AI discovering and validating vulnerabilities before attackers do, software could become safer by design rather than continually patched after flaws are found. However, as noted, this capability must evolve alongside cybercriminal tactics. Attackers are already leveraging AI to speed up exploitation and obfuscate malware. The key is for defenders to move faster and smarter - something EM Dash promises to enable.
What You Need to Know Microsoft’s Codename EM Dash is an AI system that coordinates over 100 agents to find and validate critical software bugs. It recently discovered 16 major vulnerabilities in Windows networking and authentication code, including high-impact remote code execution flaws. Unlike typical automated security, EM Dash uses AI agents that challenge and debate findings to minimize false positives and verify real risks. This marks a turning point for cyber defense, as AI now matches or exceeds expert-level vulnerability research at speed and scale.
Microsoft integrated these findings into the most recent Patch Tuesday updates, highlighting rapid transition from discovery to remediation. The approach is scalable and could influence how software security is managed industry-wide, not just at Microsoft. As attackers turn to AI, such advanced defenses become essential for individuals and businesses relying on Windows and cloud services. The Bottom Line Microsoft’s unveiling of Codename EM Dash demonstrates that agentic AI is not just theoretical - it’s actively detecting and helping fix the most dangerous vulnerabilities before attackers can exploit them.
This technology is ushering in a future where software can be systematically reviewed and secured at unprecedented speed, promising better protection for everyone. For users, keeping software updated is still essential - but with tools like EM Dash coming online, the tide in cybersecurity is turning. Subscribe to Security Now for more in-depth security analysis and updates: https://twit.tv/shows/security-now/episodes/1079 Share: Copied!
Security Now #1079 May 19 2026 - Daybreak and Codename MDASH Microsoft’s Edge Password Blunder All Tech posts Contact Advertise CC License Privacy Policy Ad Choices TOS Store Twitter Facebook Instgram YouTube Yes, like every site on the Internet, this site uses cookies. So now you know. Learn more Hide Home Schedule Subscribe Club TWiT About Club TWiT FAQ Access Account Members-Only Podcasts Update Payment Method Connect to Discord TWiT Blog Recent Posts Advertise Sponsors Store People About What is TWiT.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
Decision Logic: The Difference Between an Answer and a DecisionThe AI Forecast · on Agentic AI87 / 100
KYA Won't Always Protect You. The Real Risk Is the Swarm!Fintech Conversations & Insights with Efi Pylarinou · on Agentic AI86 / 100
Agentic AI in Sales: What Business Leaders Need to KnowScaling with AI · on Agentic AI86 / 100
EP284 Closest Alligator to the Canoe: How Transforming SOC Became P0 for Lloyds BankCloud Security Podcast by Google · on Agentic AI85 / 100
AI Is Ready for Government. Is Government Ready?The So What from BCG · on Agentic AI84 / 100
Beyond the Simplistic Narrative that AI will Replace Software with Mahesh RajasekharanSaaS Scaled · on Agentic AI83 / 100
SN 1085: A SOTA State-Sponsored Campaign - AI's New Superpower: Loop Engineering69 / 100
SN 1084: The Residential Proxy Threat - Malicious Proxies in Your Living Room45 / 100
SN 1083: Patch Tuesday à la AI - Arch Linux Repo Under Siege38 / 100
SN 1082: The Malicious Use of AI - Anthropic's Red Team Report44 / 100
SN 1081: AI Captured the Flag - Personal AI: Productivity Superpower or Privacy Threat?35 / 100