Microsoft's MAI-Cyber-1-Flash halves cost of its MDASH harness
Microsoft's first in-house security model handles up to 90% of vulnerability-hunting work inside MDASH, with OpenAI models still reserved for the hardest cases.
A small model built for one job
Microsoft on July 27 introduced MAI-Cyber-1-Flash, its first purpose-built cybersecurity model, alongside MDASH, the multi-agent harness that runs it. The model descends from the company's MAI-Thinking-1 lineage and was trained in-house on security data curated for the task; its target capability is narrow and concrete — finding exploitable vulnerabilities in large, unfamiliar codebases.
MDASH is the more consequential half of the announcement. It orchestrates more than 100 specialised agents across discovery, triage, reproduction and remediation, and routes work by difficulty: MAI-Cyber-1-Flash handles up to 90% of the volume, while the residual hardest cases escalate to a costlier frontier model — Microsoft cites GPT-5.4. The company reports the combination scores 95.95% on CyberGym, the standard benchmark for code vulnerability discovery, ahead of configurations using Mythos, Gemini and GPT models, and cuts cost roughly in half versus the previous all-frontier MDASH setup.
Microsoft attributes the result to three inputs: its own models, the trillions of daily security signals flowing through its infrastructure, and hand-tuned agent orchestration. MDASH ships with enterprise controls including role-based access, tenant isolation and sandboxed execution.
Still dependent at the top end
The routing design is an admission as much as an optimisation. Microsoft has not replaced OpenAI in its security stack; it has demoted it to the expensive tail. That is a familiar pattern for the company's MAI effort, which has repeatedly shipped competent small models for high-volume work while leaving the hardest reasoning to its partner's frontier systems.
Why it matters
Security was one of the first domains where agent economics broke down: exhaustive vulnerability hunting means running a frontier model over millions of lines, and the token bill scales faster than the findings. A distilled specialist that clears nine in ten cases turns a research demo into something a security organisation can afford to run continuously. It also sharpens the open-weights argument playing out elsewhere this week — Microsoft has now demonstrated that a small, tightly scoped security model plus good orchestration beats general frontier intelligence on cost, which is precisely the case open-model advocates make for defenders.