Microsoft's MAI-Cyber-1-Flash Beats Every AI Security Model at Half the Cost

Microsoft has shipped its first purpose-built cybersecurity model, and the benchmark numbers are hard to ignore. MAI-Cyber-1-Flash, running inside the company's multi-agent scanning harness MDASH, scores 95.95% on CyberGym, the primary industry benchmark for evaluating how AI systems reason over large codebases to find real-world vulnerabilities. That's a 12-point lead over Anthropic's Mythos 5, achieved at half the cost of Microsoft's own previous best configuration.

The release bundles a specialized model, a proprietary multi-agent harness, and decades of Microsoft threat data, all co-optimized together. It also introduces Project Perception, an agentic security platform built on top of MDASH that automates broader security workflows beyond vulnerability scanning.

The benchmark that matters

CyberGym is a corpus of 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source projects. It tests whether a system can not only identify a bug but prove it is exploitable, a much harder bar than static analysis. Here's how the field currently stacks up:

One caveat worth noting: the MDASH result is a system score, not a standalone model score. MAI-Cyber-1-Flash is paired with GPT-5.4 inside the harness, so the comparison pits a tuned multi-model pipeline against standalone models. That's a deliberate architectural choice, but it's worth keeping in mind when reading the headline number.

How the harness works

MDASH, short for Multi-model Agentic Scanning Harness, is the real engineering story. Built by Microsoft's Autonomous Code Security (ACS) team, several of whom came from Team Atlanta, the group that won the $29.5M DARPA AI Cyber Challenge, the harness orchestrates over 100 specialized agents across a five-stage pipeline:

1. Prepare: Ingests the codebase, builds language-aware indices, and maps the attack surface from past commits.
2. Scan: Specialized auditor agents run over candidate code paths, generating hypotheses and evidence for potential vulnerabilities.
3. Validate: A second cohort of "debater" agents argues for and against each finding's reachability and exploitability. Disagreement between agents is itself a signal.
4. Dedupe: Semantically equivalent findings are collapsed.
5. Prove: The system constructs and executes actual triggering inputs to confirm the bug exists, turning a candidate finding into a proven exploit path.

That final stage is what separates MDASH from a glorified linter. A scanner that produces candidate bugs generates a triage backlog. MDASH only surfaces findings it can actually demonstrate.

Smart routing cuts costs in half

MAI-Cyber-1-Flash was designed to handle up to 90% of all tasks efficiently, reserving the larger, more expensive GPT-5.4 for the 10% of cases that genuinely need it. Most vulnerability scanning tasks don't require a frontier-scale model, so a compact, security-specialized model handles the bulk of the work cheaply. The result is a 50% cost reduction compared to running GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex across the board.

What it was built on

MAI-Cyber-1-Flash derives from Microsoft AI's internally developed MAI-Thinking-1 reasoning model, fine-tuned specifically for security work. The model itself is arguably the least differentiated part of the stack.

The real advantage is training data. Microsoft processes more than 100 trillion security signals every day across identity, endpoint, cloud, and network, drawn from operational insight across 1.6 million customers. That history of real exploits and remediations is something no competitor can manufacture. The model also runs on a live reinforcement loop: every vulnerability found, patched, and confirmed feeds back into the next training run.

What it found in production

When Microsoft ran MDASH against its own Windows networking stack, it found 16 new CVEs in a single Patch Tuesday cohort, including four Critical remote code execution flaws in components like the Windows kernel TCP/IP stack and the IKEv2 service. On retrospective benchmarks against five years of confirmed MSRC cases, MDASH achieved 96% recall on clfs.sys and 100% recall on tcpip.sys.

The bugs weren't easy ones. One CVE required reasoning about object lifetimes across non-trivial control flow and three concurrent free paths spanning multiple files. Another aliasing bug spanned six source files and was only visible by comparing it against a correctly handled pattern elsewhere in the same codebase. These are exactly the bugs single-model systems miss.

Project Perception: broader automation

Perception deploys teams of specialized agents to simulate attacks, detect and investigate incidents, and fix and remediate findings. Beyond software vulnerability scanning, it will use MAI-Cyber-1-Flash for alert triage, threat hunting, and continuous monitoring. The platform sits on top of MDASH and is designed to automate the full security workflow, not just the scanning step.

Safety and access

MAI-Cyber-1-Flash went through review by Microsoft's AI Red Team, adversarial testing, and an independent third-party assessment. The model is calibrated for defense and is available only to verified defenders through MDASH, with enterprise controls including role-based access, tenant isolation, encryption, auditability, and sandboxed execution environments with no internet access.

Access is currently through a registration process. You can sign up for MDASH on the Microsoft Security site. The system is already deployed by Fortune 500 companies, with broader availability rolling out now.

Where the industry is heading

Microsoft's launch comes days after Google Cloud rolled out CodeMender. Every major player is converging on the same architecture: specialized models, multi-agent pipelines, and domain-specific data as the real differentiator. The question for security teams is no longer which model a tool uses, but what the system does around the model.

Building the harness, context, and action space independently of any single model family means that when a better model ships next quarter, the harness carries over. Customers' investments in scope files, plugins, and calibrations don't get discarded.

For security teams, the practical shift is already underway: periodic scanning and eventual patching is giving way to continuous, AI-driven vulnerability discovery that can move from finding a flaw to generating a patch inside the same automated pipeline.