Microsoft introduced MAI-Cyber-1-Flash, a compact security model built to find vulnerabilities in complex codebases, and integrated it into MDASH, the company’s multi-agent vulnerability identification and remediation harness. The combined system scores 96% on CyberGym and is positioned to run at roughly 50% of the cost of Microsoft’s previous MDASH configuration, by routing most tasks to the new model and reserving larger models for the hardest cases.<\/p>\n
The model is designed to handle up to 90% of tasks that flow through MDASH, leaving the remaining 10%, the most difficult cases, to larger, more expensive models in Microsoft’s fleet, including GPT-5.4. That routing is the source of the cost saving. According to Microsoft, the unified MDASH + MAI-Cyber-1-Flash configuration delivers 96% on CyberGym, which the company calls the gold standard benchmark for evaluating how systems reason over large codebases to find real vulnerabilities. Microsoft also reports that the configuration outperforms Mythos, Gemini, and GPT on CyberGym, and runs at 50% of the cost of its earlier MDASH offering built on GPT 5.4, 5.4 mini, and 5.3 codex.<\/p>\n
The pitch is straightforward: security is an always-on function, the volume of inbound attacks is enormous, and token cost has become the practical limit on how much code defenders can scan. By splitting traffic between a cheap, focused model and a heavier general model, MDASH keeps operating cost down while keeping accuracy close to the ceiling. The approach leans on three pieces Microsoft says it jointly optimized: the model, the data, and the harness.<\/p>\n
MAI-Cyber-1-Flash is a code-heavy security model derived from the MAI-Thinking-1 lineage, built in-house. Microsoft is publishing a technical report with the full details. The model is compact by design, which is what lets it carry 90% of the workload without paying the inference cost of a frontier generalist.<\/p>\n
Microsoft frames its data advantage as the hardest thing for competitors to replicate. The company draws on decades of security work and reports more than 100 trillion security signals per day, gathered across identity, endpoint, cloud, data, browser, and applications, with operational insight from 1.6 million customers. That telemetry feeds a reinforcement learning loop in which actions (what was exploitable, what was contained, what was blocked) are tied to outcomes. The loop is the basis for continuous improvement of the cyber models.<\/p>\n
MDASH is the multi-agent system around the model. Microsoft says it is tuned by in-house security experts who have built more than 100 agents using multiple leading models, with roles covering finding, validating, and remediating vulnerabilities. Alongside the new model, Microsoft also launched Perception, an agentic security system within MDASH that runs teams of agents to continuously monitor, patch, and close new threat vectors. Perception will also soon use MAI-Cyber-1-Flash for security workflows beyond software vulnerabilities.<\/p>\n
Microsoft describes MAI-Cyber-1-Flash as its first cyber model, and built in several layers of evaluation. The model was trained with a security-first calibration, evaluated by Microsoft’s AI Red Team, tested through automated and expert-led adversarial exercises, and independently assessed by a third party. Through MDASH, customers get enterprise-grade controls including role-based access controls, tenant isolation, encryption, auditability, and sandboxed execution environments with no internet access.<\/p>\n
CyberGym is presented as the benchmark for reasoning over large codebases to surface real vulnerabilities. Microsoft reports a 96% score for the combined MDASH + MAI-Cyber-1-Flash system, which it says is 12 points above Mythos. Microsoft also claims the system beats Gemini and GPT on the same benchmark, though the post does not list per-model scores or a date for the comparison.<\/p>\n
MAI-Cyber-1-Flash is Microsoft’s compact, code-heavy security model derived from the MAI-Thinking-1 lineage, built in-house and designed to find vulnerabilities in complex codebases.<\/p>\n
MDASH is Microsoft’s multi-agent vulnerability identification and remediation harness. It uses more than 100 agents built by in-house security experts across multiple leading models to find, validate, and remediate vulnerabilities.<\/p>\n
Microsoft says the MDASH + MAI-Cyber-1-Flash configuration runs at 50% of the cost of its previous MDASH setup built on GPT 5.4, 5.4 mini, and 5.3 codex, by routing up to 90% of tasks to the new model.<\/p>\n