MS Insists Windows 11 Isn’t Less Secure After 1,100+ Fixes, Warns Hackers Can Exploit Flaws Within Hours

Windows required more than 1,000 security fixes in October 2026, but MS insists that the operating system is not “less secure” and warns users against delaying Windows updates. The company is concerned that AI will uncover even more critical bugs as it accelerates its own AI-powered vulnerability detection in an “agentic” mouse-and-rat game.

According to MS’s October Security Update Guide, the company’s broader October 2026 security release addressed 1,413 CVEs across its product portfolio.

MS’s warnings are not sudden. I have been observing them for the past six months, with the clearest warning arriving in July 2026.

Jeremy Chapman, a director at MS 365 who works closely with Windows customers on security, strongly advised against delaying Windows updates. He also noted that MS no longer recommends postponing monthly updates for three days or more because “the risk is real” and “total addressed vulnerabilities have been on the rise since April this year.”

“If you’re not delivering critical quality updates with security fixes until a couple of weeks after they’ve been issued, that’s ample time for attackers using AI to find and exploit known security gaps,” Jeremy warned.

If you are unconvinced by Jeremy’s warning, consider the growing number of vulnerabilities reported each month and compare them with the figures from 2025. I created this table using MS’s security portal, ensuring that it accurately reflects the current state of Windows security.

Each new month makes the previous one appear less alarming, while raising questions about how much further the number of security issues could increase.

MS is also using AI to help develop these fixes, raising questions about whether this approach is contributing to more bugs for regular users. Windows bugs continue to affect consumer features, including the built-in File History backup tool, which remains broken, and the USB audio bug, which has not yet been fully patched.

MS Says More Fixes Do Not Mean Windows Is Less Secure

According to MS, users should not assume that Windows is less secure simply because it has received thousands of fixes, even as the company warns that the number could increase further.

MS argues that Windows is establishing a new standard for vulnerability management through significant advances in AI-enabled security vulnerability analysis. This enables MS and its partners to identify bugs on a much larger scale.

At the same time, MS acknowledges that “AI is accelerating vulnerability discovery on both sides.”

“It can help defenders find and fix vulnerabilities earlier,” said Nuno Costa, Partner Director of Windows Servicing and Delivery. “It can also help attackers search for vulnerabilities before fixes are available and analyze published fixes after release. All of this increases the importance of timely protection.”

MS says it is using AI at scale to identify Windows bugs and help engineers patch them faster than ever. However, it maintains that its quality standards remain high and that neither Windows code nor the company’s patch-testing process has been compromised.

“The number of CVEs doesn’t tell the full story, though,” MS’s security chief noted in a lengthy document reviewed by Windows Latest. “We are using AI to examine more code, more deeply.”

“A higher number of CVEs does not mean Windows has become less secure,” the company insists. “It means more vulnerabilities have been discovered and closed, reducing the opportunities attackers have to exploit them.”

MS maintains that more Windows bugs are being identified because the company is examining more code and being more transparent about its findings.

“Transparency makes those fixes more actionable,” the company argues, noting that CVE information helps external researchers and security teams better understand vulnerabilities affecting Windows.

At a recent hardware event, MS promised to make Windows even more secure. However, users should not expect vulnerability numbers to decline, as the situation is unlikely to return to what it was several years ago.

MS Is Using AI to Find Windows Bugs, but Attackers Can Use It Too

MS has highlighted its own tool, MDASH, an AI-powered scanner that uses the company’s security model while also incorporating technology from partners such as Anthropic’s Mythos. The tool includes specialized agents designed to identify and validate potential vulnerabilities.

However, AI has not replaced engineers, at least not yet. Although AI identifies bugs and assists with developing fixes, a human engineer remains involved and makes the final decisions. AI also helps engineers quickly determine which Windows versions are affected by a specific bug, enabling faster delivery of fixes.

MS does not want users to delay monthly updates because, once an update is released and the related CVEs disclose vulnerability details, malicious actors can use AI to analyze the fix and understand the underlying vulnerability.

MS warns that this process could happen within hours, which is why it urges users to install updates as soon as they become available. Jeremy made the same point earlier, but MS’s data showed that fewer than half of the enterprise devices in its sample had installed the security update after two weeks.

Windows updates can introduce bugs, but malware or ransomware infections can cause far greater harm. Users should therefore avoid delaying updates for more than three days. If a delay is necessary, they should browse the internet cautiously and run only trusted programs.

Windows Latest depends on readers like you. Make us your preferred source on Google Discover and Google Search, and help our independent reporting reach more people.