Cybersecurity & Privacy

Microsoft Launches MAI-Cyber-1-Flash, Its First Security AI Model — but Still Leans on OpenAI for the Hardest Tasks

Microsoft says the model inside its MDASH harness tops the CyberGym benchmark at half the cost of rivals, yet routes the toughest 10% of cases to OpenAI's GPT-5.4.

Microsoft announced MAI-Cyber-1-Flash on Monday — its first cybersecurity-specialized AI model — integrated into MDASH, its multi-agent vulnerability identification and remediation harness. “Today we’re announcing MAI-Cyber-1-Flash inside of MDASH, our multi-agent vulnerability identification and remediation harness. Together they deliver world-class performance at 50% of the cost of leading models,” Microsoft AI chief Mustafa Suleyman and security VP Hayete Gallot wrote on the Microsoft AI blog.

The company says the combination scores nearly 96% — 95.95%, per figures reported by Decrypt — on the CyberGym benchmark, beating Anthropic’s Mythos 5 (83.8%), OpenAI’s GPT-5.5 Cyber (85.6%) and GPT-5.6 Sol (83.6%), and Gemini 3.5 Flash Cyber (83.2%). “We’re shipping this into production immediately,” Suleyman said at an event in San Francisco.

Microsoft also launched Perception, an agentic security platform that deploys red, blue and green agent teams to simulate attacks, detect and triage bugs, and take corrective actions, with the tools headed to preview on November 3, according to TechCrunch.

MAI-Cyber-1-Flash still leans on OpenAI for the hardest 10%

Underneath the benchmark bravado sits a more nuanced architecture. The compact model, derived from Microsoft’s MAI-Thinking-1 lineage, handles up to 90% of tasks; MDASH routes the roughly 10% hardest cases to OpenAI’s GPT-5.4, meaning Microsoft still depends on its partner for the toughest work, as The Decoder notes. The 50% cost saving is measured against Microsoft’s current best MDASH configuration, which runs entirely on OpenAI models.

MDASH itself uses more than 100 specialized agents that audit code, debate findings, and build proofs of concept; CyberGym asks agents to reproduce 1,507 known vulnerabilities across 188 open-source projects. Decrypt cautions that the 95.95% evaluates the full MDASH system — with its GPT-5.4 fallback — not the new model alone, and that Microsoft’s self-reported score had not yet appeared on CyberGym’s public leaderboard at publication time.

The move continues Microsoft’s push to reduce reliance on OpenAI models across its stack, after it replaced OpenAI’s image models with its own MAI technology in Power Platform products earlier this month. Dave Weston, lead engineer for Perception, described the payoff: “We’ve gone from this taking hours and hours of manual work from multiple specialized folks across the security organization — appsec hunters, remediation engineers, you name it — and in minutes, we have a fix for all of this.”

An AI security arms race gets crowded

Microsoft is not alone in weaponizing frontier models for defense. Anthropic launched its Mythos security platform earlier this year through the Glasswing partner program, and OpenAI launched its own security offering in May via a program called Daybreak, per TechCrunch. Monday’s announcement drops Microsoft’s entry directly into that contest — with the advantage, the company argues, of telemetry no rival can match: “No one can manufacture this history,” the blog post says of the trillions of daily security signals flowing through its systems.

Gallot framed Perception as a way for enterprise defenders to “defend against AI with AI at the scale and speed that the attackers have.” MDASH is entering private preview through Microsoft Security Exposure Management in the Defender portal, where customers can scan Git repositories — currently limited to about 256MB — and generate proposed fixes via the Defender CLI.

The timing is no accident: the announcement landed the same day Nvidia unveiled its 37-member Open Secure AI Alliance, to which Microsoft contributed MDASH itself — a reminder that in AI security, today’s competitors are also each other’s infrastructure.

FAQ

What is MAI-Cyber-1-Flash?

Microsoft’s first cybersecurity-specialized AI model, a compact system derived from the MAI-Thinking-1 lineage and built to find challenging vulnerabilities in complex codebases inside the MDASH harness.

Does the new model replace OpenAI inside Microsoft security tools?

Only partially. MAI-Cyber-1-Flash handles up to 90% of tasks, but MDASH routes the hardest roughly 10% of cases to OpenAI’s GPT-5.4.

When can customers use these tools?

MDASH scanning is entering private preview via the Microsoft Defender portal, and TechCrunch reports the Perception agentic security tools arrive in preview on November 3.