Microsoft's MAI-Cyber-1-Flash Beats Every AI Security Model at Half the Cost
Microsoft's first in-house cybersecurity model hits 96% on CyberGym, beating Anthropic and OpenAI at half the cost
- Microsoft launched MAI-Cyber-1-Flash, its first purpose-built cybersecurity model, scoring 95.95% on CyberGym — 12 points above Anthropic's Mythos 5.
- 50% cost reduction vs. the previous best MDASH configuration (GPT-5.4 + GPT-5.4 mini + GPT-5.3 Codex), by routing 90% of tasks to the compact MAI-Cyber-1-Flash.
- MDASH harness orchestrates 100+ specialized agents across a 5-stage pipeline: prepare, scan, validate, dedupe, and prove — only surfacing confirmed exploitable bugs.
- Project Perception also launched: a new agentic security platform using MDASH for continuous monitoring, alert triage, and automated remediation workflows.
- Built on MAI-Thinking-1 and trained on 100 trillion daily security signals from 1.6M customers — a data moat competitors can't replicate.
- Access via registration at aka.ms/AI-drivenScanningHarness; available now to verified enterprise defenders through MDASH.
Microsoft has shipped its first purpose-built cybersecurity model, and the benchmark numbers are hard to ignore. MAI-Cyber-1-Flash, running inside the company's multi-agent scanning harness MDASH, scores 95.95% on CyberGym, the primary industry benchmark for evaluating how AI systems reason over large codebases to find real-world vulnerabilities. That's a 12-point lead over Anthropic's Mythos 5, achieved at half the cost of Microsoft's own previous best configuration.
The release bundles a specialized model, a proprietary multi-agent harness, and decades of Microsoft threat data, all co-optimized together. It also introduces Project Perception, an agentic security platform built on top of MDASH that automates broader security workflows beyond vulnerability scanning.
The benchmark that matters
CyberGym is a corpus of 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source projects. It tests whether a system can not only identify a bug but prove it is exploitable, a much harder bar than static analysis. Here's how the field currently stacks up:
| System | CyberGym Score |
|---|---|
| MDASH: MAI-Cyber-1-Flash + GPT-5.4 | 95.95% |
| OpenAI GPT-5.5 Cyber | 85.6% |
| Anthropic Mythos 5 | 83.8% |
| OpenAI GPT-5.6 Sol | 83.6% |
| Google Gemini 3.5 Flash Cyber (CodeMender) | 83.2% |
One caveat worth noting: the MDASH result is a system score, not a standalone model score. MAI-Cyber-1-Flash is paired with GPT-5.4 inside the harness, so the comparison pits a tuned multi-model pipeline against standalone models. That's a deliberate architectural choice, but it's worth keeping in mind when reading the headline number.
How the harness works
MDASH, short for Multi-model