Microsoft has released MAI-Cyber-1-Flash, its first dedicated cybersecurity model, and connected it to MDASH, a vulnerability-hunting system that the company says outperformed Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol while cutting cost by 50% versus Microsoft’s current best MDASH configuration.
Microsoft reports a 95.95% CyberGym score
According to Microsoft, the combined setup scored 95.95% on CyberGym. The benchmark asks AI agents to reproduce 1,507 known vulnerabilities across 188 open-source projects, then grades them by the percentage of flaws successfully reproduced in a controlled environment.
On Microsoft’s numbers, that put MDASH ahead of GPT-5.5 Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 83.2%.
The score was self-reported by Microsoft. At publication time, it had not appeared on CyberGym’s public leaderboard, though Microsoft noted that the benchmark uses a public test set and a defined success metric.
MAI-Cyber-1-Flash handles most tasks, with GPT-5.4 taking the hardest 10%
Microsoft said MAI-Cyber-1-Flash does not operate on its own. The model handles as much as 90% of the workload, while MDASH routes the hardest 10% to GPT-5.4.
That split matters on cost. Tokens, the chunks of text an AI model processes, cost money each time a model reads code or generates an answer.
Microsoft CEO Satya Nadella wrote, “This is the first time a Microsoft model built for efficiency is capable of beating a dense state of the art model built with general capabilities in mind.” He also said, “When combined with MDASH, (MAI-Cyber-1-Flash) delivers world-class performance at 50 percent of the cost of leading models.”
Model and harness play different roles in the system
Microsoft drew a distinction between the model and the surrounding system. In this setup, MAI-Cyber-1-Flash is the model that reasons over code. MDASH is the harness around it: the agents, tools, checks, and workflow that decide where to look, challenge suspected findings, remove duplicates, and prove that a bug can actually be triggered.
Microsoft said MDASH uses more than 100 specialized agents to audit code, debate whether a finding is real, and build a proof of concept showing that the flaw exists.
Microsoft says AI is changing how bugs are found and validated
The company said occasional scans and delayed patching are becoming obsolete as AI lowers the cost of bug discovery. Microsoft argued that decades of security data give it an edge, adding, “No one can manufacture this history.”
Since the release of Claude Mythos, cybersecurity researchers have been trying to match or beat its capabilities. Researchers have reproduced Mythos-style vulnerability hunting with public models for under $30 per scan. Dawid Moczadło, one of the researchers involved, said, “the moat is moving from model access to validation.”
The scarce part, as described in the report, is increasingly the system that can prove findings without burying developers in false alarms.
Microsoft’s result sits about 10 points above GPT-5.5 Cyber
Decrypt previously reported that GPT-5.5 Cyber had recently taken the public CyberGym lead with a score of 85.6%, narrowly ahead of Mythos. Microsoft’s reported result is about 10 points higher than GPT-5.5 Cyber and 7.5 points above MDASH’s previous result, though the test covers the full system rather than MAI-Cyber-1-Flash alone.
Private preview is live in Defender, with current limits on size and concurrency
Microsoft is making MDASH available in private preview through Microsoft Security Exposure Management in the Defender portal. Customers can scan Git repositories, view findings ranked from unlikely to proven, and use the Defender CLI to generate proposed code fixes for developer review.
The preview currently limits repositories to roughly 256MB and allows one concurrent scan per tenant. Microsoft said Project Perception is expected to extend the same multi-agent approach beyond code scanning into broader threat monitoring and remediation workflows.