Microsoft is threatening legal action for disclosing exploits | The VergeSkip to main contentThe homepageThe VergeThe Verge logo.The VergeThe Verge logo.TechReviewsScienceEntertainmentAIPolicyNotificationsNotificationsHamburger Navigation ButtonThe homepageThe VergeThe Verge logo.NotificationsNotificationsHamburger Navigation ButtonNavigation DrawerThe VergeThe Verge logo.Login / Sign UpcloseCloseSearchTechExpandAmazonAppleFacebookGoogleMicrosoftSamsungBusinessSee all techReviewsExpandSmart Home ReviewsPhone ReviewsTablet ReviewsHeadphone ReviewsSee all reviewsScienceExpandSpaceEnergyEnvironmentHealthSee all scienceEntertainmentExpandTV ShowsMoviesAudioSee all entertainmentAIExpandOpenAIAnthropicSee all AIPolicyExpandAntitrustPoliticsLawSecuritySee all policyGadgetsExpandLaptopsPhonesTVsHeadphonesSpeakersWearablesSee all gadgetsVerge ShoppingExpandBuying GuidesDealsGift GuidesSee all shoppingGamingExpandXboxPlayStationNintendoSee all gamingStreamingExpandDisneyHBONetflixYouTubeCreatorsSee all streamingTransportationExpandElectric CarsAutonomous CarsRide-sharingScootersSee all transportationFeaturesVerge VideoExpandTikTokYouTubeInstagramPodcastsExpandDecoderThe VergecastVersion HistoryNewslettersArchivesStoreVerge Product UpdatesSubscribeFacebookThreadsInstagramYoutubeRSSThe VergeThe Verge logo.Microsoft is threatening legal action for disclosing exploitsNotificationsNotificationsComments DrawerNotificationsCommentsLoading commentsGetting the conversation ready...TechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechNewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsMicrosoftCloseMicrosoftPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All MicrosoftMicrosoft is threatening legal action for disclosing exploitsThe company is feuding with a security researcher publicly posting vulnerabilities.The company is feuding with a security researcher publicly posting vulnerabilities.by Terrence O'BrienCloseTerrence O'BrienWeekend EditorPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Terrence O'BrienMay 30, 2026, 3:19 PM UTCLinkShareGiftImage: The VergeTerrence O'BrienCloseTerrence O'BrienPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Terrence O'Brien is the Verge’s weekend editor. He has over 18 years of experience, including 10 years as managing editor at Engadget.Microsoft is facing criticism for its handling of zero-day exploits. Someone going by the name Nightmare Eclipse has been publicly feuding with the company, posting proof-of-concept exploit code. Some of their posts suggest that they’re a disgruntled former employee. But what caught cyber security researcher Kevin Beaumont’s eye was how Microsoft has responded.Microsoft suggests it plans to bring a criminal case against Nightmare Eclipse for failing to follow “proper coordination” in disclosing vulnerabilities. They also disabled Nightmare Eclipse’s GitHub, GitLab, and Microsoft Security Response Center accounts disabled. As Beaumont points out, “It’s quite difficult to ‘responsibly’ report future vulnerabilities when you have been banned.”What troubles Beaumont is that Microsoft has hired people who have done many of the exact same things. They’ve employed people who have publicly posted zero-day exploits, some with criminal hacking convictions on their record. Microsoft has also purchased exploits from brokers.Beaumont sums it up:If Microsoft’s tactic is to try to criminalise not following often arbitrary “responsible disclosure” frameworks, good luck defending that in court — because there’s a whole clown car of prior decision making within Microsoft and facts which would emerge in that process.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Terrence O'BrienCloseTerrence O'BrienWeekend EditorPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Terrence O'BrienMicrosoftCloseMicrosoftPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All MicrosoftNewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsSecurityCloseSecurityPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All SecurityTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechMost PopularMost PopularHow Ferrari bungled the design of its first EVNvidia, Microsoft, and Arm are all teasing Nvidia’s new N1X laptop processorsThis is MSI’s new Claw 8 EX AI Plus gaming handheldKia’s flagship EV has a battery problemThis AI startup will clean your home for free to train future robotsThe Verge DailyA free daily digest of the news that matters most.Email (required)Sign UpBy submitting your email, you agree to our Terms and Privacy Notice. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.Advertiser Content FromThis is the title for the native adMore in TechAI grifters are creating fake Black people to sell Shein junkHow one founder’s bet on ‘the old school web’ is paying offThis is the James Bond game we’ve been waiting forThe SpaceX IPO is great for Elon Musk and terrible for youNvidia, Microsoft, and Arm are all teasing Nvidia’s new N1X laptop processorsAcer’s launching a Linux handheld for streaming your PC gamesAI grifters are creating fake Black people to sell Shein junkNicole Froio1:00 PM UTCHow one founder’s bet on ‘the old school web’ is paying offAllison Johnson1:00 PM UTCThis is the James Bond game we’ve been waiting forDavid Pierce12:00 PM UTCThe SpaceX IPO is great for Elon Musk and terrible for youElizabeth Lopatto12:00 PM UTCNvidia, Microsoft, and Arm are all teasing Nvidia’s new N1X laptop processorsTom WarrenMay 29Acer’s launching a Linux handheld for streaming your PC gamesStevie BonifieldMay 29Advertiser Content FromThis is the title for the native adTop Stories1:00 PM UTCAI grifters are creating fake Black people to sell Shein junk1:00 PM UTCHow one founder’s bet on ‘the old school web’ is paying off12:00 PM UTCThe SpaceX IPO is great for Elon Musk and terrible for you12:00 PM UTCSometimes, a short game hits the spotMay 29Trump’s mass deportations are only possible with racial profiling26 seconds agoWelcome to Night Vale host Cecil Baldwin shares his tech pet peevesThe VergeThe Verge logo.FacebookThreadsInstagramYoutubeRSSContactTip UsCommunity GuidelinesArchivesAboutEthics StatementHow We Rate and Review ProductsCookie SettingsTerms of UsePrivacy NoticeCookie PolicyLicensing FAQAccessibilityPlatform Status© 2026 Vox Media, LLC. All Rights ReservedNotifications DrawerThe VergeThe Verge logo.Sign in to see your notifications or create an account to join the conversation.Sign in

Microsoft is currently facing legal action threats related to the disclosure of security exploits, stemming from a public feud with a security researcher named Nightmare Eclipse who posted proof-of-concept exploit code. This conflict highlights tensions regarding the handling of zero-day vulnerabilities and responsible disclosure practices. Cybersecurity researcher Kevin Beaumont observed Microsoft's response to this disclosure, which led him to question the company's tactics. Microsoft suggested the intention to pursue criminal charges against Nightmare Eclipse for allegedly failing to adhere to "proper coordination" in vulnerability disclosure. Furthermore, Microsoft took punitive action by disabling Nightmare Eclipse’s accounts on GitHub, GitLab, and the Microsoft Security Response Center. Beaumont noted the difficulty in responsibly reporting future vulnerabilities when an individual has been formally banned, suggesting that Microsoft's approach created an environment where future reporting is hampered.

Beaumont further analyzed the situation by pointing out that Microsoft has employed personnel who have a history of posting zero-day exploits, some of whom possess criminal hacking convictions on record, and the company has also purchased exploits from brokers. This context leads Beaumont to summarize that Microsoft's strategy appears aimed at criminalizing noncompliance with often arbitrary "responsible disclosure" frameworks. He contends that defending such actions in court will be challenging due to a history of prior internal decision-making and facts within Microsoft that would emerge during legal proceedings.