Microsoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the Cost
Microsoft has announced a new cybersecurity AI model, MAI-Cyber-1-Flash, integrated within its MDASH vulnerability identification and remediation harness. The model, combined with GPT-5.4, achieved a 95.95% score on CyberGym, representing a 50% cost reduction compared to its previous MDASH configuration. While impressive, the results are presented at the system level and require careful review due to potential inaccuracies in generated text and code. This launch is part of Project Perception, a broader initiative to coordinate defensive security agents.
Microsoft has launched a new cybersecurity AI model, MAI-Cyber-1-Flash, as part of its MDASH vulnerability identification and remediation harness. The company claims that MDASH, utilizing MAI-Cyber-1-Flash and GPT-5.4, achieved a 95.95% score on CyberGym, a benchmark test that evaluates an agent's ability to reproduce vulnerabilities from unpatched source code. This represents a significant improvement over a previous MDASH configuration, which scored 88.4% in May. Microsoft states that this new model represents a 50% cost reduction compared to its previous best MDASH model mix, consisting of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.
MAI-Cyber-1-Flash is a sparse mixture-of-experts transformer with 137 billion total parameters and a 256,000-token context window, developed from a MAI-Thinking-1 mid-training checkpoint. It is designed to handle 90% of MDASH tasks, with GPT-5.4 reserved for the most challenging 10%. Microsoft emphasizes that the 95.95% score is presented at the system level and that generated text and code should be carefully reviewed due to potential inaccuracies.
Benchmark testing took place in a network-isolated environment, with no access to production systems or external services. The model card notes scores of 0.314 on CVEBench, 0.553 on CyberSecEval4 threat intelligence, 0.33 on its malware-analysis test, and 0.651 on CRSBench at POV=1200. Notably, MAI-Cyber-1-Flash scored zero across the kernel, userspace, and browser categories of ExploitGym, indicating an inability to turn vulnerabilities into working code-execution exploits.
This launch is part of Project Perception, Microsoft’s broader system for coordinating defensive security agents. The company plans to extend the model beyond software vulnerability work to additional security workflows. The announcement and model card do not disclose the token use, call volume, latency, task mix, or compute allocation behind the 50% cost saving claim, making independent verification difficult.