- Published on
A 5B-Active-Parameter Cyber Model That Pushes MDASH to 95.95% on CyberGym
- Authors
- Name
- DeepHorus
Microsoft AI has released MAI-Cyber-1-Flash, its first model specifically designed for cyber defense, marking a significant advancement in automated vulnerability discovery. The model operates exclusively within MDASH, Microsoft’s multi-model agentic scanning harness, rather than as a standalone endpoint. This release underscores Microsoft’s commitment to leveraging specialized AI for security tasks, particularly in identifying and patching software vulnerabilities at scale.
MAI-Cyber-1-Flash is a transformer architecture incorporating self-attention and sparse Mixture-of-Experts layers, boasting 137 billion total parameters with only 5 billion active per inference. It supports a 256,000-token context window and processes text-only inputs and outputs. The model is a cybersecurity-specialized fine-tune of MAI-Code-1-Flash, the lightweight coding agent already integrated into GitHub Copilot and VS Code, and is derived from the MAI-Thinking-1 lineage.
On the CyberGym benchmark, which comprises 1,507 real-world vulnerability reproduction tasks from 188 OSS-Fuzz projects, MDASH running MAI-Cyber-1-Flash alongside GPT-5.4 achieved a score of 95.95%. This represents roughly 12 percentage points above Anthropic’s Mythos, with competing systems ranging from 83.2% to 85.6%. Previously, in May 2026, MDASH scored 88.45% using only generally available models, already the top public leaderboard entry. The improvement to 95.95% came from replacing 80% of the models in the harness.
MDASH manages over 100 specialized agents across five stages—Prepare, Scan, Validate, Dedupe, and Prove—with auditors, debaters, and a Prove stage using AddressSanitizer for C/C++ targets. To control costs, MAI-Cyber-1-Flash handles up to 90% of tasks, escalating the hardest 10% to GPT-5.4, yielding a 50% cost reduction over previous configurations. Developed by Microsoft’s Autonomous Code Security (ACS) team, which includes members from the DARPA AI Cyber Challenge-winning Team Atlanta, MDASH has already assisted in generating 16 CVEs, including four critical remote code execution flaws in Windows networking and authentication stacks.
Notably, MAI-Cyber-1-Flash scores zero on ExploitGym benchmarks by design, as it is trained for defensive patching, not offensive exploit generation. This deliberate limitation ensures the model serves as a defender-only tool, a critical feature for a product aimed at security professionals. The research team emphasizes that a 5B-active parameter model capable of driving a 95.95% discovery pipeline without generating exploits is exactly what a cybersecurity product requires.
Access to MAI-Cyber-1-Flash is gated, reflecting the sensitive nature of cybersecurity tools. Looking ahead, Microsoft plans to further integrate such models into its security products, potentially expanding MDASH’s capabilities. This release signals a trend toward specialized, cost-efficient AI models that prioritize defense over offense, reshaping how organizations approach vulnerability management.
