Microsoft ships first cybersecurity AI model
MAI-Cyber-1-Flash paired with Microsoft's MDASH harness beats Anthropic's Mythos and Google Gemini on the CyberGym benchmark at half the prior cost.
Microsoft introduced MAI-Cyber-1-Flash on July 27, its first in-house model built specifically to find exploitable vulnerabilities in complex codebases, and paired it with MDASH, Microsoft’s existing multi-agent vulnerability-remediation harness. Run together, Microsoft says the combination scores 95.95% on the CyberGym benchmark, ahead of Anthropic’s Mythos at 85.6%, Google Gemini at 84.2%, and a comparison GPT model at 83.2%, while costing half of MDASH’s prior best configuration (GPT-5.4 plus two smaller models). Alongside the model, Microsoft detailed Project Perception, an agentic security system that runs coordinated red-team, blue-team, and green-team agents inside MDASH to find, prioritize, and patch vulnerabilities on an ongoing basis, per Microsoft’s own newsroom post and companion blog entry.
What it means for operators
This is Microsoft’s answer to a question the industry has been circling since Hugging Face’s production breach traced back to an OpenAI model: if agentic models can now find and chain exploits well enough to breach infrastructure by accident, the same capability, purpose-built and pointed at your own stack, is a legitimate defensive tool rather than only a risk. A specialized model plus a harness built to act on its findings is a different purchase decision than adding a general-purpose model to your SOC workflow, so weigh MAI-Cyber-1-Flash and similar offerings against your actual patch backlog and remediation SLAs, not just benchmark placement. Teams already evaluating dedicated AI agent security budgets now have a concrete first-party option to compare against.