Microsoft AI Releases MAI-Cyber-1-Flash: A 5B-Active-Parameter Cyber Model That Pushes MDASH to 95.95% on CyberGym
Microsoft AI has launched MAI-Cyber-1-Flash, its first mannequin constructed particularly for cyber protection. The mannequin doesn’t ship as a standalone endpoint. It runs inside MDASH, Microsoft’s multi-model agentic scanning harness.
MAI-Cyber-1-Flash
MAI-Cyber-1-Flash is a transformer with self-attention and sparse Mixture-of-Experts layers. It carries 137B complete parameters with 5B energetic, and a 256k context size. Inputs and outputs are textual content solely.
It is a cybersecurity-specialized fine-tune of MAI-Code-1-Flash, the light-weight agentic coding mannequin already embedded in GitHub Copilot and VS Code. The launch describes it as derived from the MAI-Thinking-1 lineage.
Benchmarks
CyberGym is a public suite of 1,507 real-world vulnerability copy duties drawn from 188 OSS-Fuzz tasks. Microsoft evaluated at CyberGymnasium’s default stage 1 configuration, which provides weak supply and a high-level description.
MDASH operating MAI-Cyber-1-Flash alongside GPT-5.4 scores 95.95%. Microsoft frames this as roughly 12 factors above Anthropic’s Mythos, and the launch chart locations the 4 competing techniques between 83.2% and 85.6%.
When Microsoft first detailed MDASH in May 2026, the harness scored 88.45% on CyberGymnasium utilizing solely typically obtainable fashions. That was already the highest public leaderboard rating, about 5 factors forward of the subsequent entry at 83.1%. The analysis workforce states the development plainly: changing 80% of the present fashions in MDASH moved the harness from 88.4% to 95.95%.
Why the routing is the true product
MDASH manages over 100 specialised brokers by 5 levels: Prepare, Scan, Validate, Dedupe, and Prove. Auditor brokers flag findings, debater brokers argue exploitability (utilizing disagreement as sign), and the Prove stage executes triggering inputs with ASan for C/C++ targets.
To management frontier mannequin prices at scale, MAI-Cyber-1-Flash handles up to 90% of MDASH duties, escalating the toughest 10% to GPT-5.4. This routing yields a 50% price saving over the earlier configuration of GPT-5.4, 5.4 mini, and 5.3 codex.
MDASH was developed by Microsoft’s Autonomous Code Security (ACS) workforce, that includes members from the DARPA AI Cyber Challenge-winning Team Atlanta. In May, MDASH-assisted work generated 16 CVEs (together with 4 Critical distant code execution flaws) within the Windows networking and authentication stack. Retrospectively, it recovered 96% of 28 MSRC circumstances in clfs.sys and 100% of seven circumstances in tcpip.sys over a five-year window.
Performance
The analysis workforce current standalone outcomes from a light-weight terminal harness:
| Benchmark | MAI-Cyber-1-Flash |
|---|---|
| CVEBench | 0.314 |
| CyberSecEval4 — Threat Intel | 0.553 |
| CyberSecEval4 — Malware Analysis | 0.33 |
| CRSBench | 0.651 (POV=1200) |
| ExploitGym — Kernel / Userspace / Browser | 0 / 0 / 0 |
The straight zeros on ExploitGym are deliberate, not a defect. Microsoft workforce states the mannequin was educated to carry out defensive duties resembling patching bugs, and never offensive duties resembling deploying malware. A 5B-active mannequin that can’t generate exploits however can drive a 95.95% discovery pipeline is precisely the artifact a defender-only product wants.
How to use it
Key Takeaways
- MAI-Cyber-1-Flash is 137B complete / 5B energetic, a sparse MoE fine-tune of MAI-Code-1-Flash with 256k context.
- 95.95% on CyberGymnasium is a system rating — MDASH plus the brand new mannequin plus GPT-5.4, up from 88.45% in May 2026.
- It handles up to 90% of MDASH duties, escalating the laborious 10% to GPT-5.4 for a claimed 50% price lower.
- ExploitGym scores are 0/0/0 by design — the mannequin patches bugs, it doesn’t write exploits.
- Access is gated
The submit Microsoft AI Releases MAI-Cyber-1-Flash: A 5B-Active-Parameter Cyber Model That Pushes MDASH to 95.95% on CyberGym appeared first on MarkTechPost.
