MAI-Cyber-1-Flash addresses 90% of vulnerabilities, GPT-5.4 handles the rest

Microsoft's MAI-Cyber-1-Flash model cuts vulnerability remediation costs in MDASH by half by handling 90 percent of security tasks.

Microsoft's first in-house model dedicated to cybersecurity, MAI-Cyber-1-Flash, is being integrated into MDASH, the multi-agent harness that the company dedicates to identifying and remediating software vulnerabilities. Compact and code-oriented, it follows in the footsteps of the internally trained MAI-Thinking-1 and, according to its spec sheet, is a fine-tuned version of MAI-Code-1-Flash.

The principle lies in a division of labor. The small model absorbs up to 90% of queries, spots vulnerabilities, applies patches, and verifies that they hold. The remaining 10%, deemed exceptionally difficult, are routed to a model about ten times larger, in this case GPT-5.4. Microsoft estimates the savings at 50% compared to the MDASH configuration currently in production, which combines GPT-5.4, 5.4 mini, and 5.3 codex.

On CyberGym, a benchmark suite that subjects agents to more than 1,500 cases drawn from 188 real-world software projects, the company claims a 95.95% success rate for this pairing. The documentation details the progress made internally: substituting the new model for 80% of those previously deployed in MDASH reportedly raised the system's score from 88.4% to this figure.

Perception accompanies this movement. This agentic security system makes teams of agents available for different workflows, with the ambition of continuously monitoring, patching, and closing threat vectors. MDASH already has more than a hundred agents built on several models to find, validate, and remediate.

The dual-use nature of cyber capabilities leads to restricted access: the model remains confined to MDASH and was trained on defensive, not offensive, tasks. Microsoft reports an evaluation by its AI Red Team, automated and expert adversarial exercises, and an independent third-party review, with execution in a private sandbox without internet access, tenant isolation, and role-based controls. The preview is expected on November 3.