Microsoft's new AI defense model hits 95.95% bug-finding rate but can't exploit a thing

Microsoft just dropped its first model purpose-built for cyber defense, and the design choices say a lot about where AI security is heading. MAI-Cyber-1-Flash isn’t a standalone product. It’s a 137B-parameter sparse mixture-of-experts model with only 5B active parameters, fine-tuned from the MAI-Code-1-Flash lineage that already powers GitHub Copilot. It runs exclusively inside MDASH, the company’s multi-model agentic scanning harness developed by the Autonomous Code Security team — a group that includes members from the DARPA AI Cyber Challenge-winning Team Atlanta.

The benchmark numbers are eye-catching but need context. MDASH running MAI-Cyber-1-Flash alongside GPT-5.4 scored 95.95% on CyberGym, a public suite of 1,507 real-world vulnerability reproduction tasks drawn from 188 OSS-Fuzz projects. That’s roughly 12 points above Anthropic’s Mythos system. Back in May 2026, the same harness using off-the-shelf models hit 88.45% — already the top public leaderboard score. The research team credits replacing 80% of the model fleet for the jump. Earlier MDASH-assisted work generated 16 CVEs in Windows networking and authentication, including four Critical RCEs, and retrospectively recovered 96% of 28 MSRC cases in clfs.sys and 100% of 7 cases in tcpip.sys over five years.

What’s clever here is the routing economics. MAI-Cyber-1-Flash handles up to 90% of MDASH tasks, escalating only the hardest 10% to GPT-5.4. Microsoft claims a 50% cost saving over the previous configuration. MDASH itself orchestrates over 100 specialized agents across five stages — Prepare, Scan, Validate, Dedupe, Prove — with auditor agents flagging findings and debater agents arguing exploitability using disagreement as signal. The Prove stage executes triggering inputs with ASan for C/C++ targets. It’s a genuine system, not a model with a chatbot wrapper.

But the most telling detail sits in the ExploitGym column: zero across the board. That’s by design. Microsoft trained this model to patch bugs, not write exploits. A 5B-active model that can drive a 95.95% discovery pipeline but can’t generate attacks is exactly what a defender-only product needs — and a clear signal that Microsoft sees liability-proofing as a feature, not a limitation.