Microsoft launches MAI-Cyber-1-Flash inside MDASH, a cost-cut vulnerability hunting system
Microsoft has launched MAI-Cyber-1-Flash in MDASH, its multi-agent system for identifying and remediating vulnerabilities. Microsoft reports that the combined system reached 96% on the CyberGym vulnerability benchmark and reduced the cost of its previous model configuration by 50%.
What happened
According to Microsoft, MAI-Cyber-1-Flash is a compact, code-heavy security model embedded in MDASH, its multi-agent system for identifying and remediating software vulnerabilities. A later Microsoft announcement gave MDASH an updated CyberGym score of 96.55, describing the result as a score on the public benchmark of real-world vulnerabilities.
Are you affected?
Microsoft says MDASH supports code scanning, vulnerability finding, validation and remediation, while Project Perception is in preview and uses red, blue and green agents across the attack lifecycle. Owners can check with their website host, software provider or managed security provider whether MDASH or Project Perception has been enabled for the systems they operate.
What to do now
- Ask the provider of your website, booking, payment or customer-management software whether it uses MDASH, Project Perception or another automated vulnerability-scanning system.
- Review open support tickets and recent change records for patches, plugins, scripts or platform updates related to security findings.
- Confirm that your hosting account, domain administrator and other critical accounts have current access controls and multifactor authentication enabled.
- Keep production systems backed up and test updates in a staging environment before they are applied to a live website or booking service.
- For a local business, check the Google Business Profile for unusual posts, contact-detail changes or links that the business did not approve.
What the new cost figures mean for local businesses
The release focuses on software security rather than local search.
Microsoft says MDASH can send up to 90% of security tasks to MAI-Cyber-1-Flash and reserve larger models, including GPT-5.4, for the most difficult 10%. It compares the combined system with a prior configuration made up of GPT-5.4, 5.4 mini and 5.3 codex. The company reports that the new arrangement runs at 50% of the cost of that configuration.
The company later disclosed a measured per-finding figure. Microsoft reported: “Across 182 confirmed crash findings, generating a PoC averaged $3.61 in model cost and 21.5 minutes.” According to Microsoft, the per-case averages reflect all attempts for successful cases using GPT-5.5.
How the multi-agent system works
MAI-Cyber-1-Flash was derived from the MAI-Thinking-1 lineage and built for code-heavy security work. Microsoft says MDASH uses more than 100 agents based on multiple models to find, validate and remediate vulnerabilities in large codebases. Agents can independently assess suspected weaknesses, merge duplicate findings and demonstrate a flaw rather than only asserting that it exists.
Project Perception extends the approach into wider security workflows. Its red agents probe for weaknesses, blue agents investigate threats and green agents remediate and harden systems. Microsoft says people remain responsible for strategy, guardrails and high-impact decisions, while the agents handle coordinated analysis across endpoints, identities, cloud systems and applications.
What training data supports the system?
Microsoft cites more than 100 trillion security signals per day across identity, endpoint, cloud, data, browser, application and network activity, drawn from a customer base of 1.6 million. It also points to a history of exploits and remediations through the Microsoft Security Response Center.
The company describes this as a live reinforcement learning loop in which investigation, triage, hunting and remediation outcomes inform future models. It says the data and actions connected to those outcomes give the models a record of what was exploitable, contained, blocked or effective.
What controls are included?
Microsoft says the model underwent security-first calibration, evaluation by its AI Red Team, automated and expert-led adversarial testing, and an independent third-party assessment. MDASH includes role-based controls, tenant isolation, encryption, auditability and sandboxed execution without internet access.
Local owners still need to control administrator access, update plugins and platforms, monitor customer-facing forms and ensure that any change to a Google Business Profile comes from an approved action.
FAQ
What is MAI-Cyber-1-Flash?
MAI-Cyber-1-Flash is a compact, code-heavy security model derived from the MAI-Thinking-1 lineage. It is designed to handle up to 90% of tasks in a security pipeline while larger models handle harder cases.
How does MDASH perform on CyberGym?
Microsoft reports that MDASH with MAI-Cyber-1-Flash scored 96% on CyberGym, 12 percentage points above Mythos. A later Microsoft announcement gave MDASH an updated score of 96.55.
How much does the new MDASH configuration cost?
Microsoft says the new configuration runs at 50% of the cost of its prior GPT-5.4, 5.4 mini and 5.3 codex setup. In a separate evaluation using GPT-5.5, proof-of-concept generation across 182 confirmed crash findings averaged $3.61 in model cost and 21.5 minutes.
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check.