Microsoft says its newest cybersecurity model helped an internal system called MDASH hit 95.95% on CyberGym, a widely watched benchmark for AI-driven vulnerability work, while cutting costs in half. That score does not appear on CyberGym’s public leaderboard. As of July 28, the leaderboard’s top listed entry belongs to a rival agent, and Microsoft’s own prior submission still sits nearly eight points lower.
The gap does not mean Microsoft’s number is false. It means the figure describes a narrower test than the headline suggests, was generated inside Microsoft’s own isolated environment, and has not been placed where anyone outside the company can check it against competitors.
MAI-Cyber-1-Flash Handles the Easy 90%, GPT-5.4 Takes the Rest
MAI-Cyber-1-Flash is Microsoft’s first cybersecurity-specific model, built into MDASH, its multi-model vulnerability identification and remediation harness. According to the model’s published architecture card, it is a sparse mixture-of-experts transformer with 137 billion total parameters, 5 billion of them active at once, and a 256,000-token context window.
It descends from MAI-Code-1-Flash, the lightweight coding model already running inside GitHub Copilot and VS Code, fine-tuned specifically for security work. Microsoft designed it to carry up to 90% of MDASH’s task volume on its own. The remaining 10%, the hardest cases, still get routed to GPT-5.4.
Access is narrow by design. The configuration is available only through an Azure AI Foundry private preview, limited to approved MDASH customers. It is not sold as a standalone model or a general-purpose API.
A Missing Leaderboard Line
Here is where the story gets complicated. CyberGym runs a public leaderboard, and checked on July 28, it did not list Microsoft’s 95.95% result at all.
Wiz’s Atlas agent held first place with a 90.9% score, logged in a July 27 entry. Microsoft’s own most recent listed submission, dated May 12, remained at 88.4%, the same baseline figure Microsoft’s model card uses as its before-and-after comparison point. Microsoft’s public materials do not say whether the 95.95% result was ever submitted for listing.
| Agent or System | CyberGym Score | Leaderboard Status (July 28) |
|---|---|---|
| Wiz Atlas | 90.9% | Listed first, July 27 entry |
| OpenAI GPT-5.5 Cyber | 85% | Listed |
| Anthropic Mythos | 83% | Listed |
| Microsoft MDASH (prior mix) | 88.4% | Listed, May 12 entry |
| Microsoft MDASH plus MAI-Cyber-1-Flash | 95.95% | Not listed |
Read as a leaderboard, the highest number belongs to the one entry nobody outside Microsoft can verify.
What Does CyberGym Level 1 Test?
CyberGym Level 1 hands an agent a vulnerability description plus the matching unpatched source code, then checks whether the agent can produce a working proof of concept. It does not ask the agent to find a bug it was never told about, and it does not grade whether any patch the agent writes actually fixes the flaw.
That distinction matters against the field it is being compared to. CyberGym describes itself as a benchmark for evaluating AI agents’ real-world cybersecurity capabilities at scale, but Level 1 specifically is reproduction work, not discovery. Wiz built Atlas to do the opposite: point it at reviewed code and let it hunt for bugs nobody has described yet.
MAI-Cyber-1-Flash Scores Zero on ExploitGym
Microsoft also ran MAI-Cyber-1-Flash through a separate lightweight terminal harness covering other benchmarks. The results are not on CyberGym’s scale, and they do not flatter the model evenly.
- 0.314 on CVEBench, a benchmark centered on known-vulnerability exploitation
- 0.553 on CyberSecEval4’s threat-intelligence component
- 0.33 on Microsoft’s malware-analysis test
- 0.651 on CRSBench at a POV=1200 setting
- 0 across all three ExploitGym categories: kernel, userspace and browser
ExploitGym hands an agent a known vulnerability and a crashing input, then asks it to turn that into a working code-execution exploit. MAI-Cyber-1-Flash did not produce one in any of the three categories tested. Microsoft says all of this testing, across every benchmark, happened in a network-isolated environment with no access to production systems, the public internet or outside services. Its own model card adds that generated text and code may be inaccurate or incomplete and should be reviewed before any consequential use.
June’s Number and July’s Do Not Match
Microsoft has claimed a higher MDASH score before. In June, the company reported 96.55% on CyberGym. That figure counted any crash the agent triggered, including bugs that had nothing to do with the target vulnerability being tested.
Microsoft’s July materials do not say whether the 95.95% figure uses that same loose standard or a stricter one limited to the actual target bug. Without that detail, the two numbers cannot be read as a before-and-after trend, and July cannot honestly be called an improvement or a decline against June.
The model card is precise about a different pair of figures that are easy to conflate. Replacing 80% of MDASH’s existing models is what took the reported score from 88.4% to 95.95%. The separate 90% figure describes the maximum share of MDASH’s task volume MAI-Cyber-1-Flash can handle without help. One is about how much of the system changed. The other is about how much work the new model does day to day.
The model is one input, the system around it is the product.
Taesoo Kim, Microsoft’s vice president of agentic security, used that framing in June to describe how MDASH is meant to work: route easy cases to a cheap model, save the expensive one for what actually needs it, and report results at the system level rather than the model level.
What Microsoft has confirmed:
- Its own May 12 MDASH submission scored 88.4% on CyberGym’s public leaderboard.
- Replacing 80% of MDASH’s prior models is tied to the reported jump to 95.95%.
- MAI-Cyber-1-Flash is built to independently handle up to 90% of MDASH’s task volume.
What remains unconfirmed:
- Whether the 95.95% figure was ever submitted to CyberGym’s public leaderboard.
- Whether July’s scoring criterion matches June’s looser any-crash standard.
- The token use, call volume, latency and compute mix behind the claimed cost saving.
No Public Math Behind the 50% Savings Claim
Microsoft’s launch announcement defines its cost saving against MDASH’s current best model mix: GPT-5.4, GPT-5.4 mini and GPT-5.3 Codex working together. Against that combination, Microsoft says the new setup costs half as much.
Microsoft’s own product page separately describes the system as delivering comparable performance at 50% of the cost of leading models. Neither document discloses the token use, call volume, latency, task mix or compute allocation behind that comparison. Without those inputs, the saving cannot be independently reproduced or checked against how a competing vendor prices its own agent.
Wiz’s Atlas Holds the Verified Top Spot
Wiz, the cloud security company Google acquired for $32 billion in March 2026, built Atlas as a network of specialized agents rather than a single model, each one picking whichever underlying model suits a given step of the work.
Atlas beat both Anthropic’s Mythos, at 83%, and OpenAI’s GPT-5.5 Cyber, at 85%, to take the CyberGym top spot at 90.9%. But the leaderboard score is not Wiz’s main pitch. In its own testing, Wiz says Atlas found more than 200 previously unknown vulnerabilities in code that has been publicly reviewed for years, including grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel and containerd. Each finding was validated end to end with a working proof of concept before Wiz reported it.
That is the comparison Microsoft’s announcement does not confront directly. One agent’s headline number comes from reproducing bugs it was handed inside a closed test. The other’s comes from hunting bugs nobody had found, in software the whole industry already depends on.
Project Perception’s August 3 Debut
Software vulnerability management through MAI-Cyber-1-Flash is the first scenario Microsoft has announced for Project Perception, a wider system for coordinating defensive security agents. Project Perception is built around three agent roles working in a continuous loop: agents that hunt for vulnerabilities before attackers do, agents that investigate and weigh which risks actually matter, and agents that push fixes across an environment.
Project Perception opens to public preview on August 3. Microsoft has said it plans to extend the underlying model beyond software vulnerability work into additional security workflows, without yet detailing which ones or when they will arrive.
Frequently Asked Questions
Is MAI-Cyber-1-Flash Available Outside Microsoft’s MDASH?
No. It ships only through an Azure AI Foundry private preview restricted to approved MDASH customers, with no standalone model release or public API. Microsoft has tied that restriction to the dual-use nature of the tool: vulnerability discovery and exploit validation can help attackers just as easily as defenders, so access requires separate approval on top of an existing MDASH relationship.
Does MDASH’s CyberGym Score Mean Its Fixes Are Verified Correct?
Not based on what Microsoft has published. Every disclosed benchmark, including CyberGym Level 1, CVEBench and ExploitGym, tests whether the agent can identify a vulnerability or reproduce it as a working proof of concept. None of the released figures measure whether a patch MDASH generates for that vulnerability is itself correct or complete.
Was Microsoft’s 95.95% Result Independently Verified?
No outside party has confirmed it. Microsoft says all benchmark testing ran inside a network-isolated environment with no access to production systems, the public internet or external services, and the model card cautions that generated text and code may be inaccurate or incomplete and should be reviewed before consequential use.
Is MAI-Cyber-1-Flash the Same Model Used in GitHub Copilot?
No. It is a cybersecurity-specific fine-tune built from MAI-Code-1-Flash, the lightweight coding model already embedded in GitHub Copilot and VS Code. The base coding model remains a general-purpose tool; the fine-tuned security version is walled off inside MDASH and is not offered as a general application programming interface.
