Microsoft built a hacking model that cannot hack: inside MAI-Cyber-1-Flash

Microsoft released its first purpose-built cybersecurity model on 27 July, and the most revealing number in its documentation is a zero.

MAI-Cyber-1-Flash is announced by Mustafa Suleyman and Hayete Gallot as “a compact, code-heavy security model derived from the MAI-Thinking-1 lineage”, built to find hard vulnerabilities in large codebases. The model card carries the specification: a transformer with sparse mixture-of-experts layers, 137 billion total parameters with 5 billion active, a 256,000-token context window, and a lineage as a cybersecurity fine-tune of Microsoft’s MAI-Code-1-Flash. The listed developer is Microsoft Ireland Operations Limited.

The number that counts

The model does not work alone. It runs inside MDASH, Microsoft’s internal codename for what it calls a “multi-agent vulnerability identification and remediation harness” carrying more than a hundred agents built on several vendors’ models.

The result Microsoft leads with is CyberGym, a suite of more than 1,500 tasks drawn from 188 real software projects, which tests whether an AI system can reason across a large codebase and find genuine vulnerabilities. Replacing 80% of the models inside MDASH with MAI-Cyber-1 moved the harness from 88.4% to 95.95%.

Read that carefully. The 95.95% is a score for the whole harness: MDASH running with MAI-Cyber-1-Flash doing most of the work and GPT-5.4 reserved for the hardest cases. Microsoft’s framing is that the small model handles up to 90% of tasks and the expensive model takes the remaining 10%, which is where its headline claim of a 50% cost reduction comes from. Cheaper labour for the routine work, specialists on call.

Measured alone on external benchmarks, the picture is more modest and Microsoft publishes it anyway: 0.314 on CVEBench, 0.651 on CRSBench, and on CyberSecEval4, 0.553 for threat intelligence and 0.33 for malware analysis.

The zeros

Then there is ExploitGym, which measures whether a model can generate working exploits. MAI-Cyber-1-Flash scores zero on kernel, zero on userspace and zero on browser.

For a model built by the company that sees, by its own count, more than 100 trillion security signals a day, that is not a failure to report. It is the product.

The model card is direct about why. “Cybersecurity capabilities can be inherently dual-use,” it says. “Identifying and verifying vulnerabilities is critical for defenders, but dangerous in the hands of cybercriminals.” The model was “trained to carry out defensive cyber tasks such as patching bugs, and not to carry out offensive cyber tasks such as deploying malware”, and trained to forget material that would help with harms unrelated to defence.

Microsoft goes further and names the alternative approach without naming its rivals: “Some cyber specialized models are designed to be broadly permissive and have reduced guardrails. However, this can increase the risks of the models being used for malicious purposes.”

Access is restricted to match. The model is available only through Azure AI Foundry private preview, only for use inside MDASH, and only after additional approval. Any use outside defensive security operations within MDASH is listed as out of scope.

How it was tested

The red-team account is unusually specific. Microsoft’s AI Red Team ran a four-part assessment covering malware generation, vulnerability discovery in critical infrastructure, end-to-end exploit development and long-horizon planning tasks, inside a network-isolated environment with no route to production systems, the public internet or external services.

Automated adversarial testing used PyRIT, Microsoft’s red-teaming framework, drawing on more than a million multi-turn jailbreak conversations, driven by an autonomous red-teaming system built for the job. Human security experts then ran realistic scenarios on top.

Microsoft also admits the cost of that caution: safeguards “may step in more often when a request is ambiguous, lacks context, or resembles potentially harmful activity, even when the user may have a legitimate defensive goal”. A defender will sometimes be refused. Microsoft says the calibration may be relaxed as it gathers evidence.

Project Perception

Alongside the model, Microsoft introduced Project Perception, an agentic security system providing teams of agents that “continuously monitor, patch, and close new threat vectors”, with MAI-Cyber-1-Flash due to power more of its workflows.

What to watch

Two things. First, whether the 95.95% survives contact with codebases that are not in a benchmark. Second, whether restricted access holds, because a model that finds vulnerabilities at that rate is valuable to precisely the people it is being kept from, and “restricted to approved customers” is a policy control rather than a mathematical one.