Microsoft debuts MAI-Cyber-1-Flash, a low-cost model for hunting code vulnerabilities

Microsoft AI has unveiled MAI-Cyber-1-Flash, a compact, code-focused security model derived from its in-house MAI-Thinking-1 lineage, deployed inside MDASH — a multi-agent harness of 100+ agents that finds, validates, and remediates software vulnerabilities. The pitch is economic as much as technical: token cost, the company argues, is now the binding constraint for defenders facing high volumes of AI-assisted attacks. Flash is tuned to handle roughly 90% of tasks on its own while routing only the hardest 10% to a heavier model (GPT-5.4), a tiered setup Microsoft says cuts costs by 50% versus its current best configuration.

On CyberGym, a benchmark for reasoning over large codebases to surface real vulnerabilities, Microsoft claims the combined MDASH-plus-Flash system scores 96% — 12 points above a rival it calls Mythos — and says Flash beats Mythos, Gemini, and GPT. Alongside the model it is launching Perception, an agentic security offering that runs teams of agents to continuously monitor, patch, and close threat vectors. The company frames its edge as three pillars — model, data, and harness — leaning heavily on proprietary telemetry it puts at over 100 trillion daily security signals across identity, endpoint, cloud, and network from 1.6 million customers, plus a reinforcement-learning loop connecting attacks to outcomes.

Microsoft emphasizes a safety-first build: red-team evaluation, third-party assessment, and enterprise controls including RBAC, tenant isolation, encryption, auditability, and sandboxed execution with no internet access. Worth noting for readers: essentially all the performance and cost figures are vendor-supplied and self-benchmarked, and several referenced competitors and model versions (Mythos, GPT-5.4) are named without external validation, so the claims warrant independent testing before being taken at face value.