Full Report
Secret to their success: Using the right model for the right security job
Analysis Summary
# Vulnerability: AI-Driven Analysis of 200+ Open-Source Zero-Days (Project Atlas/MDASH)
## CVE Details
- **CVE ID**: Not specifically listed (The report focuses on a meta-analysis of over **200 zero-day vulnerabilities** discovered across various open-source projects).
- **CVSS Score**: N/A (Individual scores vary by specific zero-day).
- **CWE**: Various (Focus on exploitable vulnerabilities and complex attack paths).
## Affected Systems
- **Products**: Widely used open-source software repositories and codebases.
- **Versions**: Various (Specific to the 200+ zero-days identified).
- **Configurations**: General deployments of affected open-source components.
## Vulnerability Description
This report details the findings of two advanced agentic bug-hunting systems: **Wiz Project Atlas** and **Microsoft MDASH**. These systems use a "multi-model" approach to identify security flaws that traditional scanners often miss:
- **Project Atlas**: Routes different stages of research (threat modeling, hunting, validation, and PoC generation) to different models (Claude Opus 4.6 and GPT-5.5) based on task-specific performance.
- **Microsoft MDASH**: Utilizes a "Red Team" agent to simulate attack paths and a "Green Team" agent to generate remediations. It uses a custom reasoning model (**MAI-Thinking-1**) for 90% of tasks, escalating complex logic to GPT-5.4.
## Exploitation
- **Status**: **PoC available** (The agents are specifically designed to generate proof-of-concept exploits to validate findings). Over 200 zero-days have been uncovered; status of active exploitation in the wild for these specific bugs is not disclosed.
- **Complexity**: Variable (The systems are designed to chain complex vulnerabilities that require "frontier-model depth").
- **Attack Vector**: Network (Primary focus is on remotely exploitable code in open-source repositories).
## Impact
- **Confidentiality**: High (Potential for data exfiltration via identified zero-days).
- **Integrity**: High (Potential for unauthorized code execution or system modification).
- **Availability**: High (Potential for service disruption).
## Remediation
### Patches
- Microsoft MDASH includes a "Green Team" agent specifically designed to **automatically remediate** and patch the issues it finds. Vendors of the 200+ affected open-source projects are being notified to issue specific version patches.
### Workarounds
- **Continuous Scanning**: Because code changes rapidly, static point-in-time analysis is discouraged.
- **Multi-Model Validation**: Use of systems that provide "evidence-based" findings rather than just plausible AI-generated answers to reduce false positives.
## Detection
- **Indicators of Compromise**: Specific IOCs depend on the individual zero-days discovered in the 200+ repositories.
- **Detection Methods**:
- **CyberGym**: A benchmark for evaluating AI's ability to find real-world vulnerabilities.
- **Cyber Model Arena**: A Wiz-developed tool to score AI models on threat hunting and proof generation accuracy.
## References
- Wiz Blog: hxxps[://]www[.]wiz[.]io/blog/atlas-ai-vulnerability-researcher#how-atlas-works-14
- Microsoft AI Research: hxxps[://]microsoft[.]ai/news/introducing-mai-cyber-1-flash-inside-mdash/
- MAI-Thinking-1 Technical Paper: hxxps[://]microsoft[.]ai/pdf/mai-thinking-1[.]pdf