Introducing MAI-Cyber-1-Flash inside MDASH

By NewSunSEO | July 30, 2026

Microsoft AI has introduced MAI-Cyber-1-Flash, a compact, code-focused security model built to find difficult vulnerabilities in complex codebases, alongside MDASH, a multi-agent system for vulnerability identification and remediation. Together the system scores 96% on the CyberGym benchmark and runs at 50% of the cost of the prior best configuration inside MDASH, which paired GPT-5.4, 5.4 mini, and 5.3 codex.

What does the combined MDASH system achieve on CyberGym?

CyberGym is the benchmark used to measure how systems reason over large codebases to surface real vulnerabilities. The unified MDASH system, with MAI-Cyber-1-Flash handling most workloads and larger models reserved for the hardest cases, reaches 96% on CyberGym. That result sits 12 points above Mythos, and it also beats Gemini and GPT on the same benchmark, according to the announcement. The model itself was developed with a security-first calibration, evaluated by Microsoft’s AI Red Team, and independently assessed by a third party.

How does the cost split work between models?

Token cost is now the binding constraint for defenders, since security is an always-on workload. MAI-Cyber-1-Flash is tuned to absorb up to 90% of tasks inside MDASH, leaving the remaining 10% of exceptionally hard jobs for the larger, more expensive models in the fleet, including GPT-5.4. Routing work this way is what produces the 50% cost saving compared with the previous best MDASH configuration. The model is derived from the MAI-Thinking-1 lineage and was trained in-house from scratch on curated data, with full design choices covered in the accompanying technical report.

What is MDASH and how does it use agents?

MDASH is the multi-agent system for identifying and remediating vulnerabilities that anchors the release. It has been tuned by security experts who created more than 100 agents using multiple leading models, with each agent responsible for a distinct step in finding, validating, and remediating vulnerabilities. Agentic code scanning feeds Project Perception, a new agentic security system launched alongside the model. Perception provides teams of agents that continuously monitor, patch, and close new threat vectors inside MDASH, and it will soon use MAI-Cyber-1-Flash across workflows beyond software vulnerability work.

Why is the data layer treated as a separate advantage?

Microsoft treats decades of operating security products as a third pillar of the system, on equal footing with the model and the agent framework. The company reports more than 100 trillion security signals per day flowing across identity, endpoint, cloud, and network telemetry, drawn from 1.6 million customers. That history feeds the MAI reinforcement learning loop, which connects actions to outcomes such as what was exploitable, what was contained, and what was blocked, so cyber models can improve from real defender workflows rather than synthetic data alone.

What enterprise controls ship with the system?

Trust is layered through both the model and the deployment surface. MAI-Cyber-1-Flash is Microsoft’s first cyber model, and the rollout includes role-based access controls, tenant isolation, encryption, auditability, and sandboxed execution environments with no internet access. Those controls are intended to give enterprises the governance posture they expect while still benefiting from the underlying model capabilities.

How does this fit into the broader MAI model lineup?

MAI-Cyber-1-Flash joins a growing catalog of MAI models that includes MAI-Image-2.5, MAI-Voice-2, MAI-Thinking-1, MAI-Code-1-Flash, and MAI-Transcribe-1.5. MAI-Code-1-Flash is already integrated into GitHub Copilot and VS Code as a lightweight agentic coding model, while MAI-Thinking-1 is positioned for complex reasoning tasks. The cyber model extends that portfolio into defensive security, with Perception acting as the delivery vehicle for agentic workflows in customer environments.

FAQ

What is MAI-Cyber-1-Flash?

MAI-Cyber-1-Flash is a compact, code-heavy security model derived from the MAI-Thinking-1 lineage. It is designed to find challenging vulnerabilities in complex codebases and runs inside MDASH as the default model for up to 90% of tasks.

How much does the new system cost compared with the prior MDASH setup?

The MDASH configuration using MAI-Cyber-1-Flash delivers a 50% cost saving compared with the previous best MDASH offering, which combined GPT-5.4, 5.4 mini, and 5.3 codex.

What is MDASH?

MDASH is a multi-agent system from Microsoft for finding and fixing vulnerabilities. It coordinates more than 100 expert-tuned agents across multiple models to find, validate, and remediate vulnerabilities, and feeds Project Perception, a new agentic security system for continuous monitoring and patching.