Microsoft’s cybersecurity arsenal just got an AI upgrade that could redefine how enterprise teams hunt for bugs. The company’s new MAI-Cyber-1-Flash model is a lean specialist designed to find flaws in massive codebases without burning through API budgets.
A model built for a single purpose
Rather than deploying a general-purpose AI for security scanning, Microsoft built a model that activates only 5 billion of its 137 billion parameters per query. It uses a sparse mixture-of-experts design with a 256,000-token window, which lets it process large code files in a single pass. The model powers MDASH, Microsoft’s agentic scanning system that orchestrated more than 150 agents to hunt for vulnerabilities.
Early results show the approach works. During testing, the system achieved a 95.95 percent hit rate on CyberGym, a public benchmark of 1,507 reproduction tasks. That is roughly 12 points ahead of Anthropic’s Mythos and comfortably clear of the pack clustered in the low 80s.
Cost savings through smart delegation
A key design decision was building MAI-Cyber-1-Flash as a triage layer. The model handles about 90 percent of all scanning tasks, escalating only the trickiest 10 percent to OpenAI’s GPT-5.4. This routing system cuts costs by roughly half compared to running all jobs on frontier-class models.
The team behind the model draws from Microsoft’s Autonomous Code Security group, which includes members of the winning squad from the DARPA AI Cyber Challenge. Their approach has already produced real results: 16 security advisories in Windows networking and authentication code during May, four of them carrying the critical severity label for remote code execution risk. Looking back across five years of prior cases, the system re-identified 96 percent of vulnerabilities in the core driver clfs.sys and every known flaw in the TCP/IP networking stack.
