Quick Answer
MAI-Cyber-1-Flash is Microsoft’s compact, code-heavy cyber model integrated into MDASH, a multi-agent vulnerability identification and remediation harness. Microsoft reports that an MDASH configuration using MAI-Cyber-1-Flash plus GPT-5.4 scored about 96% on CyberGym, 12 points above Mythos, and reduced cost by about 50% against a named current MDASH configuration.
These are provider-reported benchmark and configuration results. They do not prove the same detection rate, cost saving, or remediation quality on a customer’s repositories.
Model, Harness, and Product Are Different
| Surface | Role | Do not infer |
|---|---|---|
| MAI-Cyber-1-Flash | Specialized cyber model for code-heavy security work | Standalone public model access or complete vulnerability coverage |
| MDASH | Multi-model, multi-agent vulnerability scanning and remediation harness | That every MDASH scenario is a Project Perception scenario |
| Project Perception | Broader agentic security system across security workflows | That the launch model already runs every Perception workflow |
Microsoft says Project Perception’s first multi-model scenario is software vulnerability management through MDASH and that MAI-Cyber-1-Flash will expand to more workflows. “Will” is a roadmap statement, not current universal availability.
How the Model Routing Works
Microsoft says MAI-Cyber-1-Flash was designed to handle up to 90% of tasks, allowing MDASH to route a smaller share of exceptionally difficult work to larger, more expensive models. The reported benchmark configuration combines MAI-Cyber-1-Flash with GPT-5.4.
The result therefore measures a system, not MAI-Cyber-1-Flash in isolation. To reproduce or compare it, record:
- exact model and harness versions;
- routing thresholds and fallback models;
- CyberGym task set and scoring method;
- tool, repository, and execution environment;
- number of retries and agent debates;
- cost denominator and comparison configuration;
- human validation of findings and fixes.
Interpreting the 96% and 50% Claims
Microsoft’s article states 95.95% in the chart and rounds the narrative to 96%. It compares the cost with its then-current MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.
Do not translate those numbers into “96% of vulnerabilities found” or “all customers save 50%.” CyberGym evaluates a bounded vulnerability-reasoning workload, while real repositories differ in languages, build systems, hidden runtime context, dependency state, and vulnerability mix. Cost also depends on routing, token use, tool execution, and review effort.
A Customer Evaluation
Use a versioned set of known vulnerable and clean repositories. Measure:
- validated vulnerabilities found and missed;
- false positives and duplicate findings;
- exploitability reasoning supported by evidence;
- accepted remediations and regressions introduced;
- time and tokens per accepted finding;
- larger-model escalation rate;
- analyst review time;
- total SCUs or product charges when applicable.
Keep unsafe exploit execution isolated and require review before applying a fix. A high benchmark score does not remove the need for sandboxing, least privilege, and rollback.
The Project Perception architecture guide explains why Microsoft combines specialized and frontier models. The public preview guide covers access and SCU billing.
Official Sources
- Microsoft AI: Introducing MAI-Cyber-1-Flash inside MDASH
- Microsoft: Rethinking security for the age of AI
Source check: August 2, 2026. Verify live model, MDASH, benchmark, access, pricing, and preview documentation before evaluation.