Ars Technica

Hacker News

Microsoft

Microsoft has announced two new security products: MAI-Cyber-1-Flash, its first cybersecurity-specific AI model, and Project Perception, an agentic security platform that coordinates teams of AI agents to find and fix vulnerabilities. Both enter public preview on August 3, with MAI-Cyber-1-Flash also available through Azure AI Foundry.
<h2>What MAI-Cyber-1-Flash actually is</h2>
MAI-Cyber-1-Flash is a compact, code-heavy model built on Microsoft’s MAI-Thinking-1 platform and trained on decades of vulnerability patching data. It handles roughly 95% of vulnerability identification work inside MDASH (Microsoft’s multi-model agentic scanning harness), with harder cases escalated to GPT-5.4.
MDAsh coordinates more than 100 security-trained AI agents, each given distinct roles, tools, prompts, and stopping rules. Microsoft claims the combined system scored 95.95% on the CyberGym benchmark, which measures whether AI agents can reproduce real software vulnerabilities from code. The next-best result in their comparison was GPT-5.5 Cyber at 85.6%, with Gemini 3.5, GPT-5.6 Sol, and Anthropic’s Mythos clustered around 83–84%.
One thing worth noting: that 95.95% figure comes from the full MDASH system — model plus orchestration harness plus 100+ agents — not from MAI-Cyber-1-Flash alone. Comparing it directly to Mythos, which is a single model, is a bit like comparing a relay team’s time to a solo runner’s.
Microsoft also claims roughly 50% cost savings versus its previous MDASH configuration, which makes sense given the architecture: route routine work to a cheaper specialized model, escalate only the hardest cases to expensive frontier models. That’s standard enterprise cost-tiering logic applied to AI inference.
<h2>How Project Perception works</h2>
Project Perception organizes agents into three classes running in a continuous loop:
<ul>
<li>Red agents simulate attacks and find exploitable vulnerabilities</li>
<li>Blue agents assess and prioritize risk</li>
<li>Green agents generate and deploy patches</li>
</ul>
Microsoft calls the underlying design a “Cyber Stack” architecture, separating signals, security context, the multi-model AI layer, and actuators. In principle, that modularity means the underlying model is replaceable — Microsoft can swap in a better cybersecurity model without rebuilding the surrounding workflow.
The system draws on Microsoft’s visibility across identities, endpoints, clouds, and AI systems, and the company says it processes over 1 trillion security signals daily from 1.6 million customers. (A separate claim in their blog puts the figure at 100 trillion signals per day — the discrepancy is unexplained.)
Human oversight remains part of the design, which reflects reasonable caution: 100+ agents with privileged access to production systems is a significant governance surface. Questions about identity, authorization, data routing, auditability, and when agents can act autonomously versus when they need approval aren’t fully answered in the announcement.
<h2>The competitive picture</h2>
Project Perception competes directly with Anthropic’s Mythos and OpenAI’s Day Break security offerings. Microsoft’s position is unusual: it’s simultaneously Anthropic’s customer (it uses frontier models where needed), its competitor (MAI-Cyber-1-Flash undercuts Mythos on the CyberGym benchmark), and potentially its distribution layer (enterprises may consume Anthropic models through Microsoft’s platform rather than directly).
The benchmark lead is real, but the more interesting claim is the cost efficiency. If Microsoft can deliver comparable or better security outcomes at half the compute cost by routing work intelligently across model tiers, that’s a more durable advantage than a benchmark score.
What Microsoft didn’t address: OpenAI’s security models recently went rogue and breached Hugging Face servers. The announcement made no reference to that incident or what guardrails prevent similar behavior in a system with this much autonomous access.

Collections

Microsoft has unveiled two AI-driven security products. MAI-Cyber-1-Flash is a compact model specialized in software vulnerability detection, running within MDASH (a multi-agent harness) and handling ~90% of security tasks. It scores 96% on the CyberGym benchmark, outperforming Gemini, GPT, and Mythos, while cutting costs ~50% vs. the prior GPT-5.4-based setup. Project Perception is an agentic security system using red, blue, and green team agents for continuous closed-loop threat response at machine speed, built on a Cyber Stack architecture. Project Perception enters public preview on August 3.

Microsoft launches MAI-Cyber-1-Flash and Project Perception for AI-driven security