Skip to content
NewsProduct launch

Microsoft opens public preview of MAI-Cyber-1-Flash inside MDASH, its first cybersecurity-specific AI model

· by Pondero Newsdesk

The short version

Microsoft opened public preview of MAI-Cyber-1-Flash on August 3 inside its MDASH agentic security platform. The 95.95% CyberGym score belongs to the full MDASH system, not the new model alone, and access is gated to approved MDASH customers on Azure AI Foundry.

Microsoft opens public preview of MAI-Cyber-1-Flash inside MDASH, its first cybersecurity-specific AI model

Microsoft's first AI model purpose-built for cybersecurity entered public preview on August 3 inside MDASH, its multi-agent vulnerability identification and remediation platform. The 95.95% CyberGym score driving the launch coverage belongs to the full MDASH system pairing MAI-Cyber-1-Flash with GPT-5.4, not to the new model in isolation. For security teams comparing it against competing platforms, that distinction matters.

What the model is

MAI-Cyber-1-Flash is a sparse mixture-of-experts transformer with 137 billion total parameters, five billion active parameters, and a 256,000-token context window, per Microsoft's model card. It is a cybersecurity fine-tune of MAI-Code-1-Flash, which was itself developed from a MAI-Thinking-1 mid-training checkpoint. Microsoft announced the model on July 27 and opened the public preview on August 3.

Inside MDASH, MAI-Cyber-1-Flash is designed to take on up to 90% of routine tasks, with GPT-5.4 handling the hardest 10%, per the launch announcement. The new configuration replaced 80% of MDASH's previous model lineup. Microsoft's model card records MDASH's CyberGym score rising from 88.4% to 95.95% after the change.

Microsoft also claimed the new configuration costs 50% less than the prior MDASH mix of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex, per the launch announcement. The announcement does not disclose the token volumes, call rates, or task mix behind that figure.

What CyberGym Level 1 measures

CyberGym Level 1 gives an AI agent a known vulnerability description plus an unpatched codebase and checks whether it can produce a working proof of concept, per The Hacker News. The test covers 1,507 historical vulnerabilities across 188 large software projects. It does not assess blind vulnerability discovery or whether a generated patch is correct.

CyberGym's public leaderboard did not list Microsoft's 95.95% result as of July 28, 2026, while showing Wiz's Atlas agent at 90.9%, per The Hacker News. Microsoft's prior MDASH submission remained at 88.4% on that leaderboard at that time. Microsoft has not confirmed whether it submitted the new result for public listing.

Why it matters for security operators

The access constraint is the first practical filter. MAI-Cyber-1-Flash is not available as a standalone API or for general use. Security teams reach it only through approved MDASH access on Azure AI Foundry. Teams running Microsoft Defender for Endpoint or Sentinel but not currently inside the MDASH program will need to apply separately.

Read the 95.95% number as a system benchmark, not a model benchmark. MDASH pairs MAI-Cyber-1-Flash with GPT-5.4 in a routing arrangement designed to cut cost while maintaining system-level performance. If the 50% cost reduction holds under independent scrutiny, it addresses a real friction point: AI inference costs at scale have complicated the economics of multi-model security platforms. Without disclosed methodology, that claim cannot yet be reproduced or normalized against other vendors.

The benchmark type also sets expectations. A 95.95% score on a known-vulnerability reproduction task says the system is good at confirming that documented flaws are exploitable. That is useful for patch prioritization and triage. It is a different capability from detecting novel vulnerabilities in untested code.

What to watch next

Microsoft has not announced a general availability date. Two concrete signals to track: whether Microsoft submits the 95.95% result to CyberGym's public leaderboard for independent listing, and how MAI-Cyber-1-Flash integrates with Defender for Endpoint and Sentinel outside the current MDASH harness.

Sources