Model Drop

MAI-Cyber-1-Flash

July 27, 2026 2 min read

MAI-Cyber-1-Flash, which Microsoft announced on July 27, 2026 as a private preview inside its MDASH code-scanning system, is Microsoft's first cybersecurity model, a small fine-tune of MAI-Code-1-Flash built to find and fix vulnerabilities.

Model: MAI-Cyber-1-Flash (MAI-Cyber-1-Flash)
Maker: Microsoft
Ship date: July 27, 2026 (private preview only)
Pricing: Not published (MDASH private preview)
Context: 256K tokens
Where you can use it:
- MDASH in Defender, approved customers only
- Foundry private preview, MDASH use only
When to reach for it:
- High-volume vulnerability scans in MDASH
- Cutting the cost of code-security sweeps
- Skip it for exploit development work
How it compares:
- Microsoft's answer to Claude Mythos
- Rivals GPT-5.5 Cyber, Gemini 3.5 Flash Cyber
What makes it different:
- Handles most MDASH tasks, GPT-5.4 the rest
- Microsoft's first cyber-specialized model
Early reactions: Coverage stressed that the headline benchmark score belongs to the whole MDASH system rather than the model, and that access is gated to approved customers.
Read more: Introducing MAI-Cyber-1-Flash inside MDASH, model card, Rethinking security for the age of AI

The benchmarks

The CyberGym rows are for the full MDASH system (MAI-Cyber-1-Flash plus GPT-5.4 for the hardest tasks), and the 95.95% headline uses the looser any-crash score against single model-plus-agent rivals; the other rows run the model alone in a lightweight terminal harness with no rivals. On the stricter target any-of score MDASH reaches 90.4%, and swapping in MAI-Cyber-1-Flash lifted MDASH from 88.4% to 95.95%. MDASH's earlier leaderboard entry without the model scored 90.97%.

Microsoft's numbers

CyberGym (MDASH system, any-crash score): 95.95%. +10.35 over GPT-5.5 Cyber (85.6%), +12.15 over Claude Mythos 5 (83.8%), +12.35 over GPT-5.6 Sol (83.6%), +12.75 over Gemini 3.5 Flash Cyber (83.2%).
CVEBench (exploiting web app bugs): 0.314.
CyberSecEval4 Threat Intel (threat intelligence): 0.553.
CyberSecEval4 Malware Analysis (malware triage): 0.33.
CRSBench (full cyber reasoning pipeline, POV=1200): 0.651.
ExploitGym (kernel, userspace and browser exploits): 0.

Independent numbers

The CyberGym leaderboard lists team-submitted results; Microsoft submitted its own entry, which uses the stricter final-submission score.

CyberGym Level 1 leaderboard (MDASH with MAI-Cyber-1-Flash, final submission): 86.26%. +3.16 over Claude Mythos Preview (83.1%), −4.64 under Wiz Atlas (90.9%).