Microsoft AI Releases MAI-Cyber-1-Flash: A 5B-Lively-Parameter Cyber Mannequin That Pushes MDASH to 95.95% on CyberGym

Microsoft AI has launched MAI-Cyber-1-Flash, its first mannequin constructed particularly for cyber protection. The mannequin doesn’t ship as a standalone endpoint. It runs inside MDASH, Microsoft’s multi-model agentic scanning harness.

MAI-Cyber-1-Flash is a transformer with self-attention and sparse Combination-of-Specialists layers. It carries 137B whole parameters with 5B energetic, and a 256k context size. Inputs and outputs are textual content solely.

It’s a cybersecurity-specialized fine-tune of MAI-Code-1-Flash, the light-weight agentic coding mannequin already embedded in GitHub Copilot and VS Code. The discharge describes it as derived from the MAI-Pondering-1 lineage.

Benchmarks

CyberGym is a public suite of 1,507 real-world vulnerability copy duties drawn from 188 OSS-Fuzz initiatives. Microsoft evaluated at CyberGym’s default degree 1 configuration, which provides susceptible supply and a high-level description.

MDASH operating MAI-Cyber-1-Flash alongside GPT-5.4 scores 95.95%. Microsoft frames this as roughly 12 factors above Anthropic’s Mythos, and the launch chart locations the 4 competing techniques between 83.2% and 85.6%.

When Microsoft first detailed MDASH in Might 2026, the harness scored 88.45% on CyberGym utilizing solely typically accessible fashions. That was already the highest public leaderboard rating, about 5 factors forward of the following entry at 83.1%. The analysis crew states the development plainly: changing 80% of the present fashions in MDASH moved the harness from 88.4% to 95.95%.

Why the routing is the actual product

MDASH manages over 100 specialised brokers by means of 5 phases: Put together, Scan, Validate, Dedupe, and Show. Auditor brokers flag findings, debater brokers argue exploitability (utilizing disagreement as sign), and the Show stage executes triggering inputs with ASan for C/C++ targets.

To regulate frontier mannequin prices at scale, MAI-Cyber-1-Flash handles as much as 90% of MDASH duties, escalating the toughest 10% to GPT-5.4. This routing yields a 50% price saving over the earlier configuration of GPT-5.4, 5.4 mini, and 5.3 codex.

MDASH was developed by Microsoft’s Autonomous Code Safety (ACS) crew, that includes members from the DARPA AI Cyber Problem-winning Staff Atlanta. In Might, MDASH-assisted work generated 16 CVEs (together with 4 Important distant code execution flaws) within the Home windows networking and authentication stack. Retrospectively, it recovered 96% of 28 MSRC circumstances in clfs.sys and 100% of seven circumstances in tcpip.sys over a five-year window.

Efficiency

The analysis crew current standalone outcomes from a light-weight terminal harness:

The straight zeros on ExploitGym are deliberate, not a defect. Microsoft crew states the mannequin was skilled to carry out defensive duties corresponding to patching bugs, and never offensive duties corresponding to deploying malware. A 5B-active mannequin that can’t generate exploits however can drive a 95.95% discovery pipeline is precisely the artifact a defender-only product wants.

Tips on how to use it

Key Takeaways

• MAI-Cyber-1-Flash is 137B whole / 5B energetic, a sparse MoE fine-tune of MAI-Code-1-Flash with 256k context.
• 95.95% on CyberGym is a system rating — MDASH plus the brand new mannequin plus GPT-5.4, up from 88.45% in Might 2026.
• It handles as much as 90% of MDASH duties, escalating the onerous 10% to GPT-5.4 for a claimed 50% price reduce.
• ExploitGym scores are 0/0/0 by design — the mannequin patches bugs, it doesn’t write exploits.
• Entry is gated