Microsoft launches MAI-Cyber-1-Flash, its first cybersecurity-specialized AI model

Microsoft AI introduced MAI-Cyber-1-Flash on July 27, 2026, its first cybersecurity-specialized model, which it says pushes its MDASH vulnerability-remediation system to a 95.95% success rate on the CyberGym benchmark at roughly half the previous cost.

The model is a sparse Mixture-of-Experts transformer with 137 billion total parameters but only 5 billion active per token and a 256,000-token context window, built as a security fine-tune of MAI-Code-1-Flash, Microsoft’s lightweight coding model. The design keeps most work on a small, cheap model and routes only the hardest cases to larger ones.

Inside MDASH – Microsoft’s multi-agent system for finding and fixing software vulnerabilities – the model handles up to 90% of security tasks itself, sending the most complex 10% to bigger models, the company said. Microsoft said MDASH processes more than 100 trillion security signals a day across 1.6 million enterprise customers.

Microsoft says the setup outperforms MDASH configurations built on Anthropic’s Claude Mythos, Google’s Gemini and OpenAI’s GPT models by as much as 12 percentage points. Those are the company’s own benchmark figures, measured on its own system and not independently verified, and CyberGym scores do not necessarily track real-world exploit discovery.

The model is also not a product anyone can buy. MAI-Cyber-1-Flash is not released as a standalone model or general API; access is limited to approved MDASH customers through an Azure AI Foundry private preview.

Whether Microsoft opens broader access, or keeps the model bottled inside MDASH, will show whether this is a platform play or a captive efficiency gain.