# Microsoft Says MDASH Beats Claude Mythos and GPT-5.6 Sol in Cybersecurity Test > Source: > Published: 2026-07-27 19:01:04+00:00 #### In brief - Microsoft says MDASH scored 95.95% on CyberGym, topping GPT-5.5 Cyber, Mythos 5, GPT-5.6 Sol, and Gemini 3.5 Flash Cyber. - MAI-Cyber-1-Flash handles up to 90% of the workload, while MDASH sends the hardest cases to GPT-5.4. - The scanner is in private preview through Microsoft Defender, where teams can review findings and generate proposed fixes. Microsoft has [released](https://microsoft.ai/news/introducing-mai-cyber-1-flash-inside-mdash/) its first dedicated cybersecurity model named MAI-Cyber-1-Flash and plugged it into MDASH, a vulnerability-hunting system that it says beats Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol while costing 50% less than Microsoft’s current best MDASH configuration, according to the company. The combined setup scored 95.95% on CyberGym, according to Microsoft. CyberGym is a benchmark that asks AI agents to reproduce 1,507 known vulnerabilities across 188 open-source projects, then scores them by the percentage successfully reproduced in a controlled environment. That put MDASH ahead of GPT-5.5 Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 83.2%. The result is self-reported by Microsoft and had not appeared on CyberGym’s public leaderboard at publication time, though the benchmark uses a public test set and a defined success metric. MAI-Cyber-1-Flash does not work alone. Microsoft says it handles up to 90% of tasks, while MDASH routes the hardest 10% to GPT-5.4. That matters because tokens—the chunks of text an AI processes—cost money every time a model reads code or produces an answer. This is the first time a Microsoft model built for efficiency is capable of beating a dense state of the art model built with general capabilities in mind. “When combined with MDASH, (MAI-Cyber-1-Flash) delivers world-class performance at 50 percent of the cost of leading models,” Microsoft CEO Satya Nadella wrote. Today, we are announcing a series of updates that give customers frontier-grade security at half the cost. MAI-Cyber-1-Flash is our first cybersecurity model, built ground up to find the most challenging vulnerabilities in complex code bases. When combined with MDASH, it… [pic.twitter.com/npcIihN1H7]— Satya Nadella (@satyanadella) [July 27, 2026] A model (in this case MAI-Cyber-1-Flash) is the AI that reasons over the code. A harness (MDASH in this case) is the machinery around it: the agents, tools, checks, and workflow that decide where to look, challenge suspected findings, remove duplicates, and prove that a bug can be triggered. MDASH uses more than 100 specialized agents assigned to audit code, debate whether a finding is genuine, and build a proof of concept—a working demonstration that the flaw exists. Microsoft said occasional scans and delayed patches are becoming obsolete as AI makes bug discovery cheaper. The company argues that decades of security data give it an advantage, adding, “No one can manufacture this history.” Ever since the release of Claude Mythos, cybersecurity experts have been trying to beat or match its capabilities. Researchers reproduced Mythos-style vulnerability hunting with public models for under $30 per scan. Dawid Moczadło, one of the researchers involved, said “the moat is moving from model access to validation.” The scarce part is becoming the system that proves findings without burying developers under false alarms. [Decrypt also reported](https://decrypt.co/371900/openai-gpt-5-5-cyber-ai-beats-anthropic-banned-claude-mythos) that GPT-5.5 Cyber had recently taken the public CyberGym lead with an 85.6% score, narrowly beating Mythos. Microsoft’s score is about 10 points above GPT-5.5 Cyber and 7.5 points above MDASH’s previous result, but it evaluates the full system rather than MAI-Cyber-1-Flash by itself. Microsoft is putting MDASH into [private preview](https://learn.microsoft.com/en-us/security-exposure-management/whats-new) through Microsoft Security Exposure Management in the Defender portal. Customers can scan Git repositories, see findings ranked from unlikely to proven, and use the Defender CLI to generate proposed code fixes for developer review. The preview currently limits repositories to roughly 256MB and permits one concurrent scan per tenant. Project Perception is expected to extend the same multi-agent approach beyond code scanning into broader threat monitoring and remediation workflows.