Microsoft Report 2026: Less than 24 hours between the discovery of a flaw and its exploitation, AI benefits attackers

Microsoft's Digital Defense Report estimates that AI benefits attackers first: 72,000 CVEs expected in 2026, phishing tripled as a gateway and the first ransom entirely orchestrated by AI.

Microsoft published its Digital Defense Report 2026, which covers the period from July 2025 to June 2026. Its main conclusion: in the short term, artificial intelligence gives the attackers a head start, using it to find vulnerabilities, write malware and conduct intrusions faster than defenders can react. The median time between the discovery of an exploited fault and its transformation into a weapon is now well below one day, and the number of VECs recorded this year is expected to reach a record of approximately 72,000.

Entrance doors evolve

In intrusions handled by Microsoft incident response teams, phishing increased from 7% to 23% of entry points, and Internet-exposed applications were operated from 15% to 24%. The report also identifies attacks directly targeting AI tools: the s1ngularity malware, broadcast via trapped npm packages, targeted Claude Code, Gemini CLI and Amazon Q CLI installations, while a browser extension installed more than 600,000 times aspired to ChatGPT and DeepSeek conversations.

Microsoft finally documents JADEPUFFER, presented as the first ransomware extortion orchestrated from end to end by an AI, which occurred in early July 2026, and notes that leading-edge models have been able to chain 32-step attacks alone in corporate environments.