Resources > AI Security Agent Flagged Critical Vulnerabilities in Microsoft Bing

In July 2026, a cybersecurity story made the rounds that was notable less for the vulnerabilities themselves and more for who found them. XBOW, a company that builds autonomous AI agents for offensive security testing, discovered two critical vulnerabilities in Microsoft Bing’s image search infrastructure. Both were rated 9.8 out of 10 on the CVSS severity scale, the highest practical tier of severity, and both could be exploited by an anonymous attacker with no login, no session, and no user interaction required.

Microsoft had already fixed both issues on its servers by the time the public advisories were issued in March 2026. XBOW held back the technical details until late July, at Microsoft’s request, giving the fix time to roll out fully before publishing how the bugs actually worked. That is exactly how responsible disclosure is supposed to go, and it is worth walking through what happened, because the story says something important about where cybersecurity is heading.

What XBOW’s AI Agent Found

The two vulnerabilities, tracked as CVE-2026-32194 and CVE-2026-32191, both lived in Bing Images. The first was reachable through Bing’s public “Search by Image” upload tool, the button that lets anyone upload a photo and search for visually similar results. The second used a different route: Bing’s own web crawler, which could be pointed at an attacker-hosted file and made to fetch it directly into the same vulnerable process.

Both paths led to the same underlying weakness in how Bing’s backend handled image files. An attacker who exploited either flaw could run commands directly on Microsoft’s production servers, with full system-level privileges, meaning the highest level of access a program can have on that machine. XBOW’s testing confirmed this worked consistently across multiple servers and network ranges within Bing’s infrastructure, which ruled out the possibility that this was a one-off misconfiguration on a single machine.

How the Vulnerability Worked, in Plain Terms

Without getting into exploit-level detail, the root cause is a well-known category of bug in image processing software. Bing’s image pipeline used a common open-source image conversion tool that, under certain conditions, can be tricked into treating part of an image file as an instruction rather than as image data. XBOW found a way to construct an SVG image, a common vector graphics format, that exploited this behavior. When Bing’s backend processed the file, it did not just render an image. It also carried out the command hidden inside it.

This kind of flaw is sometimes described as a delegate or pipeline injection issue, and it has shown up in various forms across the industry for years whenever software passes user-uploaded content into a conversion or processing tool without carefully restricting what that tool is allowed to do. It is a useful reminder that the risk in image uploads is rarely the image itself. It is what happens to that file after it leaves the user’s hands.

Why This Was Serious

A few details make this case stand out from a routine vulnerability disclosure. Neither flaw required authentication of any kind, which means anyone on the internet could have attempted to exploit them, not just a logged-in user or someone with prior access. Both were reachable through ordinary, public-facing features that Bing users interact with every day. And the level of access an attacker would have gained, full system privileges on production servers, is about as serious as remote code execution gets.

Microsoft’s own advisories rated both vulnerabilities Critical with the maximum practical CVSS score, and confirmed that no customer action was needed because the fix was applied entirely on Microsoft’s side. There is no patch for end users to install here. The lesson is not about your own Bing usage. It is about what this case reveals about how these vulnerabilities get found in the first place.

Responsible Disclosure Done the Right Way

It is worth pausing on the disclosure timeline, because it is a good example of how this process is supposed to work. XBOW found the vulnerabilities, reported them privately to Microsoft, and waited. Microsoft fixed the issues on its servers and issued advisories in March 2026, without publishing exploit details at that stage. XBOW then held its own detailed technical writeup until late July, specifically at Microsoft’s request, to make sure the fix had time to roll out across Bing’s entire production fleet before anyone published the mechanics of how the attack actually worked.

That sequencing matters. A researcher, human or AI, who publishes exploit details too early can hand attackers a roadmap before defenders have had a chance to close the door. XBOW’s approach here, patient disclosure paired with a clear technical writeup once it was safe to publish, is the standard the security industry has been asking for from AI-driven research specifically, given understandable concerns about how fast these tools can work.

This Was Not an Isolated Case

This was not XBOW’s only credited find in Microsoft’s products this year. The company was also credited with a separate critical remote code execution vulnerability in the Microsoft Devices Pricing Program, disclosed earlier in 2026 and involving an unrestricted file upload issue. Taken together, XBOW reportedly landed among the top submitters on Microsoft’s bug bounty leaderboard in 2026, reported to be the first AI system to reach that tier.
 

What This Means for the Future of Cybersecurity

The headline here is not really about Bing. It is about what it means that an autonomous AI agent can now independently discover complex, chained vulnerabilities in production software at a level that used to require experienced human researchers. That capability cuts both ways. The same techniques that let XBOW find these flaws before they were exploited are available, in less disciplined hands, to people with no intention of reporting anything responsibly.

Security researchers who have commented on this case have framed it as a shift rather than a one-time event: AI-assisted vulnerability discovery is accelerating on both sides of the fence, for defenders running their own testing and for attackers probing for weaknesses. The organizations that benefit from this shift will be the ones that adopt AI-assisted testing deliberately, rather than the ones that find out the hard way that someone else got there first.
 

What Your Business Should Take From This

Most businesses are not running anything like Bing’s infrastructure, but the underlying lesson applies broadly. Any system that accepts user-uploaded files, images, documents, or otherwise, and passes them into a backend conversion or processing tool deserves a closer look at what that tool is allowed to do with untrusted input. It is also a good moment to ask whether your organization’s security testing has kept pace with how quickly both attackers and defenders are adopting AI-assisted tools.