AnthropicはMicrosoftが修正できる速度を上回るペースでバグを発見しているAnthropic is finding bugs faster than Microsoft can fix them

Anthropic's artificial intelligence is reportedly uncovering security vulnerabilities in Microsoft's software faster than the company's own teams can patch them, according to a report from Ars Technica. The development matters because it points to a widening structural gap in modern cybersecurity: as AI accelerates the discovery of software flaws, the slower, human-intensive work of fixing them appears to be struggling to keep pace.

At the heart of the issue is an asymmetry between finding bugs and repairing them. Surfacing a vulnerability can increasingly be delegated to AI systems that read through code, reason about logic errors, and probe large software surfaces for weaknesses. Producing a fix, by contrast, still typically requires careful engineering, regression testing, and coordinated release scheduling so that a patch does not break existing systems. When one side of that equation speeds up dramatically while the other does not, a backlog of identified but unpatched issues can accumulate.

The source describes Microsoft as being "on a mad dash behind the scenes to patch exploits before hackers find them." That framing captures what security professionals often call the defender's dilemma: defenders must address every weakness, while an attacker needs to exploit only one. If AI-assisted discovery is now generating candidate vulnerabilities faster than they can be closed, the interval during which a flaw is known internally but not yet remediated becomes a period of elevated risk—especially if similar tooling becomes available to malicious actors.

Anthropic, the company behind the Claude family of large language models, has positioned itself as a safety-focused AI developer, and its models have been applied to code analysis and vulnerability research. Applying AI to hunt for software flaws reflects a broader industry trend rather than an isolated experiment. Large models can be paired with traditional techniques such as fuzzing, which feeds programs malformed or unexpected inputs to trigger crashes, and static analysis, which inspects code without running it. The combination appears well suited to scanning sprawling codebases like those underpinning Windows, Office, and cloud services.

The wider context includes comparable efforts from other major players. Google has publicized work on AI-driven bug hunting through initiatives such as Big Sleep, which the company said identified a real-world vulnerability in widely used software, building on earlier research known as Project Naptime. Security vendors and independent researchers have likewise begun integrating language models into their workflows. These moves suggest that automated discovery is likely to become a standard part of the vulnerability-research pipeline, which raises questions about how vendors will triage and prioritize a rising volume of reports.

Microsoft's remediation process is anchored by its long-running monthly release cadence, commonly known as Patch Tuesday, when the company ships bundled security updates on the second Tuesday of each month. Urgent flaws can prompt out-of-band patches outside that schedule, but the standard cycle is designed for predictability and testing rather than speed. Microsoft also operates coordinated disclosure programs and the Microsoft Security Response Center, which validate reported issues and assign severity ratings before fixes are developed and distributed. A surge in machine-generated findings would place additional strain on that pipeline.

It is worth treating the reported gap with some caution. Discovering a potential vulnerability is not the same as confirming an exploitable one, and AI tools are known to produce false positives that still require human verification. The precise scale of the discrepancy between Anthropic's discovery rate and Microsoft's patching rate is not fully detailed in the available summary, so the practical severity remains difficult to quantify. Responsible disclosure norms also mean that many such findings are shared privately with the vendor before any public exposure, which can limit real-world harm.

Even with those caveats, the underlying dynamic is significant. If AI continues to compress the time and expertise needed to find flaws, software makers may need to invest more heavily in automated patching, faster testing, and prioritization systems to keep remediation from falling behind. The episode illustrates a double-edged reality of AI in security: the same capabilities that help defenders locate weaknesses earlier could, if misused, help attackers do the same, making the race between discovery and repair increasingly central to how software is defended.