When the Windows update notification pops up, most people’s first instinct is usually to hit pause first, wait a few days or even weeks to see if other users run into any problems. After all, Windows updates occasionally introduce new bugs, and if your computer happens to have important work to handle, nobody wants to take that risk.
However, Microsoft believes this waiting period cannot be prolonged any further. As AI advances rapidly, it’s now being used to find, analyze, and even attempt to exploit software vulnerabilities. Tasks that previously took security researchers days or weeks to complete can now be done within hours. Therefore, Microsoft’s latest recommendation is: “Set update deferral to less than 3 days” to avoid leaving computers exposed to known unpatched vulnerabilities for extended periods.
Image source: Windows Latest
Microsoft warns: Don’t delay Windows 11 updates by more than 3 days! AI can now analyze vulnerabilities within hours
According to foreign media Windows Latest Compiled 2026 Patch Tuesday data shows Microsoft addressed a total of 117 vulnerabilities in January, dropping to 64 in February, 81 in March, then jumping to 169 in April. May saw a slight decrease to 120, but June rose again to 206, including 6 zero-day vulnerabilities.
If we only compare February and June, Microsoft’s monthly vulnerability processing count has increased from 64 to 206, growing more than threefold in just four months.
| Months of 2026 | Patch vulnerabilities | Zero-day vulnerability | total |
|---|---|---|---|
| January | 114 | 3 | 117 |
| February | 58 | 6 | 64 |
| March | 79 | 2 | 81 |
| April | 167 | 2 | 169 |
| May | 120 | 0 | 120 |
| June | 200 | 6 | 206 |
At this point, some people might wonder: does this mean Windows has suddenly become less secure than before?
Microsoft 365 Director Jeremy Chapman said the total number of vulnerabilities that Microsoft processes has been steadily increasing since April of this year, and one key reason is that both attackers and defenders have started using AI. AI can help security researchers identify issues that were previously difficult to detect in large amounts of code, so the increase in patches also means more hidden vulnerabilities are being found before attackers discover them.
However, the same capabilities can also be misused by bad actors. Once a vulnerability is disclosed through a security update, attackers can use AI to help read the patch contents, compare the code differences between the before and after versions, and then look for possible attack methods. Of course, this doesn’t mean every newly disclosed Windows vulnerability will be actively attacked within hours, but the barriers and time required for attackers to analyze vulnerabilities and develop exploit code are decreasing rapidly compared to the past.
Jeremy Chapman warns that “the risk is real.” In the past, companies would typically wait a week or two to confirm that an update wouldn’t affect their internal systems before rolling it out fully, but with AI-accelerated vulnerability analysis, that waiting period also becomes a research window for attackers.
In response to this change, Microsoft has also updated the Windows Autopatch and enterprise device update policy recommendations. The quality update deferral period should be set to less than 3 days, the update deadline should be set to 0 or 1 day, and the grace period should be set to 1 or 2 days. Eligible enterprise devices are also recommended to enable Hotpatch.
Of course, this doesn’t mean that once day 4 arrives, the computer will definitely be attacked.
For average Windows 11 Home or Pro users, although these settings (“less than 3 days,” “0 or 1 day,” “1 or 2 days”) are primarily designed as enterprise management policies, if you take computer security seriously, it’s best to follow Microsoft’s recommendations for enterprises and avoid pausing monthly security updates for weeks at a time.
The Windows Latest report also noted that since attackers could use AI to accelerate their research, Microsoft’s approach is to fight back using AI as well.
Microsoft has built a multi-model agent scanning system codenamed MDASH, designed to find, verify, and help patch software vulnerabilities.
The MDASH system combines frontier large language models, cost-effective distilled models, and over 100 specialized AI agents handling different tasks. They perform code scanning, propose vulnerability hypotheses, challenge from the opposing perspective whether the vulnerability can actually be triggered, eliminate duplicate results, and finally attempt to construct input data to prove the issue truly exists.
Image source: Windows Latest
Simply put, it’s like having one group find issues, another group pick them apart, and then a third group verify them. Only findings that pass multiple rounds of inspection become actual issues that need to be addressed, thereby reducing AI misjudgments.
Microsoft says MDASH has helped research teams discover 16 new vulnerabilities in Windows networking and authentication components, four of which are serious remote code execution vulnerabilities affecting components such as Windows core TCP/IP and IKEv2 services. Some issues span multiple functions and even multiple code files—looking at just one small section may not seem abnormal—they can only be found by simultaneously tracking object lifecycle, network input, and multiple concurrent processing flows.
In the public CyberGym benchmark, MDASH achieved an 88.45% success rate on 1,507 real-world vulnerability reproduction tasks from 188 open-source projects, outperforming the second-place entry on the leaderboard at the time by approximately 5 percentage points, which had a 83.1% success rate.
Image source: Windows Latest
Source: KOCPC Chinese