Microsoft unveils 100 specialized AI agents for threat hunting at Build 2026

Microsoft used its Build 2026 developer conference to unveil a new security system built around more than 100 specialized AI agents. The agents are designed to hunt for threats in real time, targeting live exploitable vulnerabilities rather than simulating attacks.

The system links directly to Microsoft Defender and GitHub. Developers receive alerts about flaws with actionable guidance, reducing the time between detection and repair.

Agentic AI for real world flaws

The new approach moves past traditional vulnerability scanning. Instead of flagging theoretical weaknesses, the agentic AI system hunts for active, exploitable flaws in production environments.

Each agent focuses on a specific attack type or threat vector. This specialization allows the system to identify subtle patterns that broader tools might miss.

Microsoft said the agents can also map vulnerabilities to relevant code repositories on GitHub. Developers can then see the exact lines of code that need changes.

Integration with Microsoft Defender

The AI agents feed data directly into Microsoft Defender, the company's enterprise security platform. This integration means security teams receive alerts in their existing workflows without switching tools.

Defender can correlate findings from multiple agents to detect coordinated attack campaigns. The system also prioritizes vulnerabilities based on risk, helping teams focus on the most critical issues first.

Why This Matters

The release signals a shift in how enterprises approach cybersecurity. Manual vulnerability patching often takes weeks. Automated agentic AI systems can cut that time to hours or minutes.

Organizations using Microsoft's ecosystem including Azure, Office 365 and GitHub will be directly affected. The system targets real exploits rather than hypothetical risks, reducing false positives that waste security team resources.

Smaller companies that lack dedicated security staff may benefit most. The automated workflows reduce the need for manual triage and analysis.

Microsoft said the system is available now in preview. Pricing follows the standard Defender licensing model. The company plans to add more specialized agents over the next year.