Microsoft Launches MAI-Cyber-1-Flash AI Model in MDASH, Claims 95.95% Vulnerability Detection at Half the Cost

Microsoft has introduced its first cybersecurity-specific AI model, MAI-Cyber-1-Flash, within its MDASH (multi-model vulnerability identification and remediation harness) platform. The company reports that MDASH, using MAI-Cyber-1-Flash alongside GPT-5.4, achieved a 95.95% score on the CyberGym benchmark, while costing 50% less than the previous best MDASH configuration that combined GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.

MAI-Cyber-1-Flash is a sparse mixture-of-experts transformer with 137 billion total parameters and five billion active parameters, featuring a 256,000-token context window. It is a cybersecurity fine-tune of MAI-Code-1-Flash, developed from a MAI-Thinking-1 mid-training checkpoint. The model is designed to handle up to 90% of MDASH tasks, with GPT-5.4 reserved for the hardest 10%. Access is limited to approved MDASH customers through an Azure AI Foundry private preview.

The headline score of 95.95% is for the MDASH system running both models, not for MAI-Cyber-1-Flash alone. CyberGym Level 1 is a known-vulnerability reproduction test that checks if an agent can produce a working proof of concept from a vulnerability description and unpatched source code. It does not measure blind vulnerability discovery or patch correctness. Microsoft’s earlier 96.55% MDASH result used different criteria, counting any crash including non-target vulnerabilities, so the two scores are not directly comparable.

Microsoft’s model card reports additional benchmark scores for MAI-Cyber-1-Flash: 0.314 on CVEBench, 0.553 on CyberSecEval4 threat intelligence, 0.33 on its malware-analysis test, and 0.651 on CRSBench at POV=1200. The model scored zero across kernel, userspace, and browser categories on ExploitGym. All testing occurred in a network-isolated environment. The model card warns that generated text and code may be inaccurate or incomplete.

Software vulnerability management using MAI-Cyber-1-Flash inside MDASH is the first scenario for Project Perception, Microsoft’s broader system for coordinating defensive security agents. Project Perception enters public preview on August 3, with plans to extend the model to additional security workflows.