# Microsoft AI Releases MAI-Cyber-1-Flash: A 5B-Active-Parameter Cyber Model That Pushes MDASH to 95.95% on CyberGym > Source: > Published: 2026-07-28 08:33:30+00:00 Microsoft AI has released [MAI-Cyber-1-Flash](https://microsoft.ai/models/mai-cyber-1-flash/), its first model built specifically for cyber defense. The model does not ship as a standalone endpoint. It runs inside **MDASH**, Microsoft’s multi-model agentic scanning harness. **MAI-Cyber-1-Flash** **MAI-Cyber-1-Flash** [MAI-Cyber-1-Flash](https://microsoft.ai/pdf/MAI-Cyber-1-Flash-Model-Card.pdf) is a transformer with self-attention and sparse Mixture-of-Experts layers. It carries **137B total parameters with 5B active**, and a **256k context length**. Inputs and outputs are text only. It is a cybersecurity-specialized fine-tune of [MAI-Code-1-Flash](https://microsoft.ai/models/mai-code-1-flash/), the lightweight agentic coding model already embedded in GitHub Copilot and VS Code. The release describes it as derived from the [MAI-Thinking-1](https://microsoft.ai/models/mai-thinking-1/) lineage. **Benchmarks** [CyberGym](https://www.cybergym.io/cybergym/) is a public suite of 1,507 real-world vulnerability reproduction tasks drawn from 188 OSS-Fuzz projects. Microsoft evaluated at CyberGym’s default level 1 configuration, which supplies vulnerable source and a high-level description. MDASH running MAI-Cyber-1-Flash alongside GPT-5.4 scores **95.95%**. Microsoft frames this as roughly 12 points above Anthropic’s Mythos, and the launch chart places the four competing systems between 83.2% and 85.6%. When Microsoft first [detailed MDASH](https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-tops-leading-industry-benchmark/) in May 2026, the harness scored **88.45%** on CyberGym using only generally available models. That was already the top public leaderboard score, about five points ahead of the next entry at 83.1%. The research team states the improvement plainly: replacing 80% of the existing models in MDASH moved the harness from 88.4% to 95.95%. **Why the routing is the real product** MDASH manages **over 100 specialized agents** through five stages: Prepare, Scan, Validate, Dedupe, and Prove. Auditor agents flag findings, debater agents argue exploitability (using disagreement as signal), and the Prove stage executes triggering inputs with ASan for C/C++ targets. To control frontier model costs at scale, MAI-Cyber-1-Flash handles **up to 90% of MDASH tasks**, escalating the hardest 10% to GPT-5.4. This routing yields a **50% cost saving** over the previous configuration of GPT-5.4, 5.4 mini, and 5.3 codex. MDASH was developed by Microsoft’s **Autonomous Code Security (ACS)** team, featuring members from the DARPA AI Cyber Challenge-winning Team Atlanta. In May, MDASH-assisted work generated **16 CVEs** (including four Critical remote code execution flaws) in the Windows networking and authentication stack. Retrospectively, it recovered **96% of 28 MSRC cases in ****clfs.sys** and **100% of 7 cases in ****tcpip.sys** over a five-year window. **Performance** The research team present standalone results from a lightweight terminal harness: | Benchmark | MAI-Cyber-1-Flash | |---|---| | CVEBench | 0.314 | | CyberSecEval4 — Threat Intel | 0.553 | | CyberSecEval4 — Malware Analysis | 0.33 | | CRSBench | 0.651 (POV=1200) | | ExploitGym — Kernel / Userspace / Browser | 0 / 0 / 0 | The straight zeros on ExploitGym are deliberate, not a defect. Microsoft team states the model was trained to perform defensive tasks such as patching bugs, and not offensive tasks such as deploying malware. A 5B-active model that cannot generate exploits but can drive a 95.95% discovery pipeline is exactly the artifact a defender-only product needs. **How to use it** **Key Takeaways** **MAI-Cyber-1-Flash is 137B total / 5B active**, a sparse MoE fine-tune of MAI-Code-1-Flash with 256k context.** 95.95% on CyberGym is a system score**— MDASH plus the new model plus GPT-5.4, up from 88.45% in May 2026.** It handles up to 90% of MDASH tasks**, escalating the hard 10% to GPT-5.4 for a claimed 50% cost cut.** ExploitGym scores are 0/0/0 by design**— the model patches bugs, it does not write exploits.** Access is gated** Asif Razzaq is the CEO of Marktechpost Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.