Key facts
- Microsoft's MDASH system, utilizing the new MAI-Cyber-1-Flash model, achieved a 95.95% score on the CyberGym cybersecurity benchmark.
- This score surpasses those of OpenAI's GPT-5.5 Cyber (85.6%), Anthropic's Mythos 5 (83.8%), OpenAI's GPT-5.6 Sol (83.6%), and Google's Gemini 3.5 Flash Cyber (83.2%).
- The MAI-Cyber-1-Flash model handles up to 90% of the workload, with MDASH sending the most challenging cases to GPT-5.4.
- Microsoft claims the combined MDASH and MAI-Cyber-1-Flash system costs 50% less than leading models.
- MDASH employs over 100 specialized agents for code auditing, finding genuine vulnerabilities, and creating proof-of-concept demonstrations.
- The MDASH system is currently in private preview through Microsoft Defender, allowing users to scan Git repositories and generate proposed code fixes.
Microsoft has announced its new cybersecurity AI model, MAI-Cyber-1-Flash, integrated into its MDASH vulnerability-hunting system. The company claims this combined setup achieved a 95.95% score on the CyberGym benchmark, surpassing competitors like OpenAI's GPT-5.6 Sol and Anthropic's Mythos 5. Microsoft CEO Satya Nadella stated that this new configuration offers world-class performance at half the cost of leading models.
The CyberGym benchmark assesses AI agents' ability to reproduce known vulnerabilities across open-source projects. Microsoft's reported score of 95.95% significantly outpaced GPT-5.5 Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 83.2%. While this result is self-reported by Microsoft, the benchmark uses a public test set and defined success metrics.
MAI-Cyber-1-Flash is designed to handle approximately 90% of the workload, with MDASH routing the remaining 10% of the most complex cases to GPT-5.4. This tiered approach aims to optimize costs, as processing tokens incurs expenses. MDASH itself utilizes over 100 specialized agents to audit code, debate findings, and construct proofs of concept for identified flaws.
Microsoft is making MDASH available in a private preview through Microsoft Defender. This allows customers to scan Git repositories, review findings ranked by likelihood, and use the Defender CLI to generate suggested code fixes for developers. The preview currently has limitations on repository size and concurrent scans.