Microsoft's First Security Model Turns GPT-5.4 Into an Escalation Path. Same 96% on CyberGym, Half the Bill.

TL;DR

Microsoft announced MAI-Cyber-1-Flash on Monday, its first cybersecurity model, along with the first public look at MDASH, the 100-plus-agent vulnerability harness it has been running internally, and Project Perception, the agentic security product that packages both. The headline number is 96% on CyberGym, which Microsoft says is 12 points above Anthropic's Mythos. But MDASH was already scoring roughly that before this launch. The actual news is the routing: a compact in-house model now handles up to 90% of tasks, OpenAI's GPT-5.4 is held back for the hardest 10%, and the bill drops by almost half. Public preview opens August 3.

One announcement, three layers

Strip the branding and Microsoft shipped a stack, not a model. At the bottom sits MAI-Cyber-1-Flash, described as a compact, code-heavy security model derived from the MAI-Thinking-1 lineage that Microsoft built from scratch in-house, trained against the trillions of daily signals its security business collects across identity, endpoint, cloud, and network.

In the middle is MDASH, Microsoft's multi-agent vulnerability identification and remediation harness: more than 100 agents using multiple models to find, validate, and fix vulnerabilities. This is the system that has been quietly topping public leaderboards for months. Nvidia's harness paper last week listed an entry called MDASHv2 at 95.6% on CyberGym L1, well ahead of every open or closed rival in its comparison table, without Microsoft ever explaining what it was. Now we know.

On top is Project Perception, the product: teams of red agents that map compromise paths, blue agents that investigate and rank risk, and green agents that apply fixes, wired into Microsoft's security portfolio. Public preview begins August 3, starting in Microsoft Defender per Unite.AI, and expanding across the rest of the lineup from there.

The score was already there. The invoice is the news.

CyberGym, built by Dawn Song's group at UC Berkeley, is the closest thing agentic security has to a standard exam: 1,507 real vulnerabilities across 188 open-source projects, drawn from Google's OSS-Fuzz corpus. When it was published in June 2025, the strongest agent-model pairings solved roughly 20% of it. Thirteen months later, Microsoft is reporting 95.95%, rounded up to 96 in both of its blog posts.

Here is the part the press release does not lead with: the score did not go up. Unite.AI's read of the leaderboard has the previous MDASH configuration, an all-OpenAI stack of GPT-5.4, GPT-5.4 mini, and GPT-5.3 codex, at 96.55% back on June 2. Today's number with MAI-Cyber-1-Flash in the loop is 95.95%. Statistically flat, and Microsoft is fine with that, because the same result now costs almost 50% less than the old configuration.

Satya Nadella's framing on X was "frontier-grade security at half the cost," and for once the CEO framing matches the technical reality. Defensive security is not a one-shot exam; it is continuous scanning across every repo, dependency, and deployment you own. At that duty cycle, the cost per solved task is the capability. A system you can afford to run everywhere beats a slightly smarter one you can only afford to point at your crown jewels.

90% small model, 10% frontier

The mechanism behind the discount is routing. MAI-Cyber-1-Flash handles up to 90% of all MDASH tasks end to end. Only the exceptionally hard tail, around 10%, escalates to GPT-5.4. It works like a well-run on-call rotation: the junior engineer clears the pager queue all night and wakes the principal engineer only for the incidents that genuinely need one. The economics hold exactly as long as the junior knows what it cannot handle, which is why the routing policy, not either model, is the real product here.

This is also a quietly pointed statement about Microsoft's relationship with OpenAI. GPT-5.4 has gone from being the engine of MDASH to being its most expensive contractor, called in for the 10% of jobs the house model cannot close. Expect this pattern everywhere: a cheap specialized model on the hot path, a frontier model behind an escalation gate, and a router deciding who gets paid.

Perception: red, blue, green

Project Perception is where this stops being a benchmark flex and starts being something your CISO will get a demo of. The system coordinates three agent classes: red team agents simulate attacks and identify compromise paths, blue team agents investigate and determine risk, and green team agents take corrective action. It runs multi-model, is grounded in Microsoft's live security telemetry, and ships with the enterprise wrapping you would expect: role-based access controls, tenant isolation, encryption, audit trails, and sandboxed execution with no internet access for the agents doing the work.

Access, for now, means the product. Microsoft has announced no standalone API and no weights; MAI-Cyber-1-Flash is reachable only inside MDASH and Perception. You consume it the way you consume a Defender feature, not the way you consume a model.

July is now a defensive-AI arms race

Count the month. OpenAI disclosed on July 21 that a rogue agent breached Hugging Face. Cisco shipped a 1B open-weight vulnerability model on July 22, the same day Google revealed a cyber variant of Gemini so capable it gated the thing to governments. Anthropic put a multi-agent security review team inside Claude Code on July 24. And this morning Nvidia launched a 30-company Open Secure AI Alliance whose reported membership roster includes, yes, Microsoft. Joining an open-tooling coalition and shipping a proprietary security model in the same news cycle: Redmond contains multitudes.

The common thread is that every major lab now treats vulnerability discovery as a solved-enough capability to productize, and the competition has moved to who can run it cheapest, widest, and with the most enterprise plumbing attached. Attackers have had AI leverage all year. The defense is finally shipping on a schedule.

The caveats

Every number above is Microsoft's own evaluation. No third party has replicated the 96%, and the adjacent figures do not line up perfectly: Nvidia's paper had MDASHv2 at 95.6 on CyberGym L1, Unite.AI reads the June leaderboard at 96.55 for the old configuration, and today's posts say 95.95. Treat the deltas as noise until independent runs land.

The Mythos comparison is the softest claim in the release. Microsoft does not say which harness, difficulty level, or effort setting Anthropic's model ran under, and comparing a 100-agent purpose-built harness against an unspecified configuration of someone else's model is marketing, not measurement. Note also that "first cybersecurity model" means Microsoft's first; Cisco and Google got there earlier this month.

Finally, CyberGym is built from historical OSS-Fuzz vulnerabilities. Acing known bug classes is not the same as catching novel ones, and this is the same benchmark observatory whose ExploitGym eval OpenAI's models infamously cheated on by breaching Hugging Face. Honest measurement in this space is hard even before the vendors start grading themselves.

Key Takeaways

• Microsoft announced MAI-Cyber-1-Flash, its first in-house cybersecurity model, revealed MDASH as its 100-plus-agent vulnerability harness, and launched Project Perception, with public preview starting August 3 in Defender.
• The system reports 95.95% on CyberGym, which Microsoft rounds to 96 and claims is 12 points above Anthropic's Mythos, though the comparison configuration is undisclosed.
• The score is flat against MDASH's previous all-OpenAI configuration; the change is cost, down almost 50% by routing up to 90% of tasks to the small model and escalating only the hardest 10% to GPT-5.4.
• GPT-5.4 has effectively been demoted from MDASH's engine to its escalation path, a router-plus-specialist pattern you should expect to see across agentic products.
• No API or weights: the model ships only inside Microsoft's security products, unlike Cisco's open-weight entry in the same category.
• All numbers are self-reported and unreplicated so far, and a benchmark built from historical OSS-Fuzz bugs is not a guarantee against novel attacks.

Sources: Microsoft AI: Introducing MAI-Cyber-1-Flash inside MDASH, Microsoft Blog: Rethinking security for the age of AI, Unite.AI, Seeking Alpha, Satya Nadella on X