Microsoft has unveiled its first dedicated cybersecurity model inside MDASH, the company’s multi-model vulnerability identification and remediation system. The new configuration pairs MAI-Cyber-1-Flash with GPT-5.4, scoring 95.95% on the CyberGym benchmark—up from the 88.4% achieved by MDASH in May. Microsoft says this combination costs 50% less than their previous best mix of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is currently restricted to approved MDASH customers via an Azure AI Foundry private preview.
That headline result belongs to the full MDASH system, not to MAI-Cyber-1-Flash alone. CyberGym Level 1 is a known-vulnerability reproduction task: given a vulnerability description and unpatched source code, an agent must produce a working proof of concept. It does not test blind discovery or patch correctness. Notably, Microsoft’s 95.95% score wasn’t listed on CyberGym’s public leaderboard as of July 28. The company’s earlier 96.55% MDASH result used a different criterion—counting any crash, including non-target vulnerabilities—so the two figures cannot be directly compared. Microsoft hasn’t clarified whether the same yardstick was used for the new score.
Under the hood, MAI-Cyber-1-Flash is a sparse mixture-of-experts transformer with 137 billion total parameters and 5 billion active, plus a 256,000-token context window. It’s a cybersecurity fine-tune of MAI-Code-1-Flash, itself derived from a MAI-Thinking-1 mid-training checkpoint. The architecture relies on intelligent routing: the smaller model handles up to 90% of MDASH tasks, while GPT-5.4 takes the hardest 10%. Microsoft reports that this swap replaced 80% of the system’s existing models. The model card lists supplementary scores—0.314 on CVEBench, 0.553 on CyberSecEval4 threat intelligence, 0.33 on malware analysis—but note these use different scales and tasks, not standalone CyberGym equivalents.
Microsoft is positioning this work under Project Perception, a broader framework for coordinating defensive security agents. Software vulnerability management inside MDASH is the first use case, with the company planning to extend the model to other security workflows. The announcement highlights cost efficiency as the central engineering claim, but does not disclose token counts, latency, or compute allocation behind the 50% savings figure. Engineers should treat the benchmark numbers as system-level results—not independent model scores—and note the model card’s warning that generated code may be incomplete and requires review before use.
Source: The Hackers News