Microsoft Says It Won’t Pursue Security Researchers After Nightmare-Eclipse Backlash

Microsoft has clarified that it does not plan to take action against people who conduct or publish security research, after a dispute over public Windows zero-day disclosures triggered criticism from the security community.

The clarification followed an earlier Microsoft Security Response Center post that criticized the public release of proof-of-concept code for several unpatched Windows vulnerabilities. The language in that post drew concern because Microsoft said its Digital Crimes Unit would continue bringing cases against actors and those enabling criminal activity.

Microsoft later softened the message through a Microsoft Security Response Center statement, saying it has no intention of pursuing individuals who conduct or publish security research. The company said it would work with law enforcement only when someone breaks the law and causes real harm to customers.

What Microsoft Clarified

The clarification matters because it draws a line between controversial security research and malicious activity. Microsoft said it values the security community and recognizes that the relationship between vendors and researchers can be fragile.

According to The Record, Microsoft’s follow-up statement acknowledged that some interactions with researchers have fallen short. The company also said it wants to learn from feedback and keep a constructive relationship with the people who report vulnerabilities.

The move came after Microsoft’s earlier post named several publicly disclosed vulnerabilities, including RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma. The company said those vulnerabilities were not shared through proper coordination before public release.

Issue	What happened	Why it matters
Initial MSRC post	Microsoft criticized uncoordinated Windows zero-day disclosures	Researchers read parts of the post as a possible legal warning
Community reaction	Security researchers criticized the wording	They warned it could discourage future vulnerability reports
Microsoft clarification	Microsoft said it will not pursue people for conducting or publishing research	The company narrowed its legal position to unlawful malicious activity
Disclosure debate	The case revived arguments over coordinated vulnerability disclosure	Vendors and researchers still disagree over timing, risk, and trust

How Nightmare-Eclipse Became The Center Of The Dispute

The controversy centers on a pseudonymous researcher known as Nightmare-Eclipse, also referred to as Chaotic Eclipse in several reports. The researcher publicly released Windows exploit code across several weeks and accused Microsoft of mishandling earlier reports.

The Hacker News reported that the dispute escalated after the researcher released multiple Windows zero-day exploits and later suggested another release could arrive in July 2026. The episode put Microsoft’s disclosure process and response language under close scrutiny.

A Barracuda analysis described Nightmare-Eclipse as an actor driven by a personal grievance against Microsoft and said the disclosures targeted parts of the Windows ecosystem, including Microsoft Defender, BitLocker, and core Windows components.

Why Microsoft Condemned The Public Exploit Releases

Microsoft’s position is that releasing working exploit code for unpatched vulnerabilities creates immediate risk for customers. In its initial MSRC blog post, the company said uncoordinated disclosures can put proof-of-concept code into the hands of bad actors before defenders have fixes.

The security research community did not dispute that unpatched exploit code can create risk. The backlash focused more on Microsoft’s wording, especially the reference to the Digital Crimes Unit and legal action against people who enable criminal activity.

That distinction became the core of Microsoft’s follow-up. In its MSRC clarification, Microsoft said it will continue to welcome vulnerability submissions through its public researcher portal, regardless of past interactions or reputation.

• Microsoft says coordinated disclosure remains central to customer protection.
• Researchers criticized language they saw as too broad or threatening.
• The clarification separates good-faith research from unlawful malicious activity.
• The dispute shows how quickly vendor-researcher trust can break down.
• The case may push vendors to improve communication around rejected or disputed reports.

Coordinated Disclosure Is Still Under Pressure

Coordinated Vulnerability Disclosure gives vendors time to investigate and patch flaws before full technical details become public. Microsoft argues that this process helps protect customers before attackers can weaponize vulnerabilities.

Other major disclosure programs use defined timelines. Google’s Project Zero disclosure policy follows a 90+30 approach, which gives vendors 90 days to make a patch available and then allows time for patch adoption if a fix arrives before the deadline.

The Zero Day Initiative disclosure policy uses a 120-day vendor remediation window when the vendor responds within the required timeframe. These fixed timelines show that researchers and vendors often work within formal rules, even when the relationship becomes tense.

Why Researchers Pushed Back

Researchers worry that broad legal language can chill security reporting. If researchers fear lawsuits or account bans, they may avoid reporting flaws, report through less formal channels, or publish anonymously without any coordination.

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community,…

— Microsoft Security Response Center (@msftsecresponse) June 1, 2026

The Record noted that Microsoft’s newer statement stopped short of addressing every allegation made by Nightmare-Eclipse, including claims involving account access and bounty handling. That leaves some trust questions unresolved, even after Microsoft narrowed its legal position.

The broader concern is not limited to one researcher. The community reaction shows that vulnerability disclosure depends on trust, clear communication, predictable rules, and fair treatment when a report becomes disputed.

Disclosure model	Typical goal	Risk if it fails
Coordinated disclosure	Give vendors time to patch before public technical details appear	Researchers may feel ignored if vendors delay or reject reports
Fixed-deadline disclosure	Create a clear timeline for vendor action and public accountability	Details may go public before a patch reaches all users
Full public disclosure	Warn the public and force urgent attention	Attackers may weaponize the bug before defenders can patch

What The Clarification Means For Security Teams

For enterprise defenders, the practical lesson is to watch both sides of disclosure disputes. Vendor advisories explain official risk and mitigation steps, while independent researchers may reveal technical details before a patch arrives.

The Hacker News report said Microsoft urged coordinated disclosure after several publicly released zero-days increased customer risk. Security teams should treat that type of release as an urgent patching and detection priority, especially when exploit code is available.

Barracuda also warned that defenders should prioritize patching relevant Windows vulnerabilities and layer detection and identity controls that do not depend only on the compromised endpoint.

What Happens Next

Microsoft has now tried to reduce the temperature around the dispute, but the episode may still influence how researchers interact with the company. The strongest repair work will likely come from clearer triage communication, faster responses to disputed reports, and transparent bounty or credit decisions.

The case also highlights the growing strain on vulnerability disclosure systems. More researchers, more automated discovery, and AI-assisted bug hunting can increase report volume, while vendors still need time to reproduce issues, assess severity, and build patches.

Google’s Project Zero and the Zero Day Initiative show that disclosure rules can work when both sides understand the process. The Nightmare-Eclipse controversy shows what can happen when trust breaks down before a fix, credit decision, or public advisory satisfies everyone involved.

Microsoft’s latest message gives good-faith researchers some reassurance, but it does not end the wider debate. Vendors want time to patch. Researchers want their reports handled fairly. Customers need both sides to cooperate before working exploit code reaches attackers.

FAQ