Microsoft AI Releases MAI-Cyber-1-Flash: 5B-Active-Parameter Cyber ​​Model Pushes MDASH to 95.95% in CyberGym

Microsoft AI has released the MAI-Cyber-1-Flash, its first model specifically designed for cyber defense. The model does not run as a standalone storage. It runs inside MDASHMicrosoft scan harness for many models.

MAI-Cyber-1-Flash is a converter capable of self-attention and minimal Mixture-of-Experts layers. It carries 137B is the number of parameters with 5B in effectand a 256k context length. Input and output is text only.

It’s a great cybersecurity-specialized plugin for MAI-Code-1-Flash, a lightweight agent model that’s already embedded in GitHub Copilot and VS Code. The release describes it as based on the MAI-Thinking-1 pedigree.

Measurements

CyberGym is a public program of 1,507 real-world risk generation activities drawn from 188 OSS-Fuzz projects. Microsoft tested on CyberGym’s level 1 default configuration, which provides a vulnerable source and a high-level description.

MDASH uses MAI-Cyber-1-Flash near GPT-5.4 scores 95.95%. Microsoft puts this as about 12 points higher than Anthropic’s Mythos, and the launch chart puts the four competing systems between 83.2% and 85.6%.

When Microsoft first explained about MDASH in May 2026, the harness got points 88.45% in CyberGym uses only commonly available models. That was already a top leaderboard result, nearly five points ahead of the next entry at 83.1%. The research team clearly states the improvement: replacing 80% of the existing models in MDASH removed the harness from 88.4% to 95.95%.

Why the router is a real product

MDASH is in charge more than 100 special agents through five stages: Configure, Scan, Validate, Dedupe, and Verify. Flag detection for accounting agents, anti-exploitation agents (using inconsistencies as a signal), and the Prove class use ASan-triggered input for C/C++ targets.

To control the cost of the frontier model at scale, the MAI-Cyber-1-Flash handles up to 90% of MDASH jobs10% hard boost to GPT-5.4. This method produces a 50% cost savings over previous GPT-5.4, 5.4 mini, and 5.3 codex configurations.

MDASH was developed by Microsoft Autonomous Code Security (ACS) team, which includes members of the Atlanta-based DARPA AI Cyber ​​Challenge winning team. In May, an MDASH-assisted operation was carried out 16 CVEs (including four remote code execution errors) in the Windows network and authentication stack. In retrospect, it recovered 96% of 28 MSRC cases in clfs.sys again 100% of cases 7 in tcpip.sys with a five-year window.

Working

The research team presents representative results from the lightweight terminal harness:

The straight zeros in ExploitGym are intentional, not a bug. Microsoft’s team says the model was trained to perform defensive tasks such as debugging, not offensive tasks such as removing malware. A functional 5B model that can produce good results but can drive a 95.95% detection pipeline is exactly the artifact that only a defender’s product needs.

How to use

Key Takeaways

• MAI-Cyber-1-Flash is 137B total / 5B activeMoE mini-track for MAI-Code-1-Flash with 256k core.
• 95.95% in CyberGym is a system result – MDASH and the new model and GPT-5.4, from 88.45% in May 2026.
• Handles up to 90% of MDASH operationsa solid 10% upgrade to GPT-5.4 with a 50% cost reduction.
• ExploitGym scores 0/0/0 by design – model closes bugs, doesn’t write functions.
• Access is gated