Microsoft's MAI-Cyber-1-Flash Beats Every AI Security Model at Half the Cost

Microsoft just shipped its first purpose-built cybersecurity model, and the numbers are hard to ignore. MAI-Cyber-1-Flash, running inside the company's multi-agent scanning harness MDASH, scores 95.95% on CyberGym , the primary industry benchmark for evaluating how AI systems reason over large codebases to find real-world vulnerabilities. That's a 12-point lead over Anthropic's Mythos 5, and it comes at 50% of the cost of Microsoft's own previous best configuration.

This isn't just a model release. It's a full-stack security play: a specialized model, a proprietary multi-agent harness, and decades of Microsoft's own threat data, all co-optimized together. The announcement also includes Project Perception, a new agentic security platform that sits on top of MDASH and automates broader security workflows beyond vulnerability scanning.

The benchmark that matters

CyberGym is a corpus of 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source projects. It tests whether a system can not only identify a bug, but actually prove it is exploitable , a much harder bar than static analysis. Here's how the field stacks up:

The gap is striking. But the key caveat is that the MDASH result is a system score, not a standalone model score. MAI-Cyber-1-Flash is paired with GPT-5.4 inside the harness, so you're comparing a tuned multi-model pipeline against standalone models. That's a real architectural choice, not a trick , but it's worth keeping in mind when reading the headline number.

How the harness actually works

MDASH , short for Multi-model Agentic Scanning Harness , is the real engineering story here. It was built by Microsoft's Autonomous Code Security (ACS) team, several of whom came from Team Atlanta, the group that won the $29.5M DARPA AI Cyber Challenge. The harness orchestrates over 100 specialized agents across a five-stage pipeline: