Microsoft released its first dedicated cybersecurity model MAI-Cyber-1-Flash on July 27 and integrated it into MDASH, a vulnerability-hunting system that scored 95.95% on the CyberGym benchmark. The company says this configuration beats Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol while costing 50% less than Microsoft's current best MDASH setup. CyberGym is a benchmark that asks AI agents to reproduce 1,507 known vulnerabilities across 188 open-source projects, scoring them by the percentage successfully reproduced in a controlled environment. Microsoft CEO Satya Nadella stated the combined system delivers world-class performance at half the cost of leading models, marking the first time a Microsoft efficiency-focused model has beaten dense state-of-the-art models built for general capabilities.
MDASH Outperforms Competing Models on CyberGym Benchmark
Microsoft's MDASH system scored 95.95% on CyberGym, according to the company. This result placed it ahead of GPT-5.5 Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 83.2%. The result is self-reported by Microsoft and had not appeared on CyberGym's public leaderboard at publication time, though the benchmark uses a public test set and a defined success metric. The score represents approximately 10 points above GPT-5.5 Cyber and 7.5 points above MDASH's previous result.
MAI-Cyber-1-Flash Handles 90% of Workload with GPT-5.4 Backup
MAI-Cyber-1-Flash does not work alone. Microsoft says it handles up to 90% of tasks, while MDASH routes the hardest 10% to GPT-5.4. The model is the AI that reasons over code, while MDASH is the harness—the machinery that includes agents, tools, checks, and workflow deciding where to look, challenging suspected findings, removing duplicates, and proving bugs can be triggered. MDASH uses more than 100 specialized agents assigned to audit code, debate whether a finding is genuine, and build a proof of concept demonstrating the flaw exists.
Microsoft Opens Private Preview Through Defender Portal
Microsoft is putting MDASH into private preview through Microsoft Security Exposure Management in the Defender portal. Customers can scan Git repositories, see findings ranked from unlikely to proven, and use the Defender CLI to generate proposed code fixes for developer review. The preview currently limits repositories to roughly 256MB and permits one concurrent scan per tenant. Project Perception is expected to extend the same multi-agent approach beyond code scanning into broader threat monitoring and remediation workflows.
FAQ
What score did Microsoft's MDASH achieve on CyberGym?
Microsoft says MDASH scored 95.95% on CyberGym, a benchmark that asks AI agents to reproduce 1,507 known vulnerabilities across 188 open-source projects.
How does MAI-Cyber-1-Flash distribute its workload?
Microsoft says MAI-Cyber-1-Flash handles up to 90% of tasks, while MDASH routes the hardest 10% to GPT-5.4. The system uses more than 100 specialized agents to audit code and validate findings.
What are the limits for the MDASH private preview?
The preview currently limits repositories to roughly 256MB and permits one concurrent scan per tenant through Microsoft Security Exposure Management in the Defender portal.
