Microsoft MDASH Reaches 95.95% on CyberGym: Why the Winning Advantage Is the Security System, Not One Model

Introduction

Microsoft has reported a 95.95% success rate on CyberGym for a new configuration of MDASH, its multi-model, multi-agent system for identifying, validating, prioritizing, and remediating software vulnerabilities.

The number is striking. The original CyberGym paper reported that its strongest tested combination—OpenHands with Claude 3.7 Sonnet—reproduced 11.9% of the benchmark’s vulnerabilities in the first published evaluation.

Microsoft’s latest result is far higher. However, the most important part of the announcement is not simply that a newer model is more capable.

The 95.95% score was produced by a complete security system combining:

• A small cybersecurity-specialized model.
• A larger frontier model for difficult cases.
• More than 100 specialized agents.
• Code-analysis and validation tools.
• Historical security data.
• Proof generation.
• Deduplication.
• Sandboxed execution.
• Human-designed orchestration.

Microsoft summarizes the approach in three words:

Model
Data
Harness

The model contributes intelligence. The data gives that intelligence security context. The harness converts model outputs into a repeatable, verifiable workflow.

This distinction matters because enterprise security teams do not buy benchmark answers. They need a system that can operate continuously, control false positives, prove that a finding is real, and help turn the result into a safe remediation.

The Reported 95.95% Result

Microsoft’s published CyberGym chart compares five model-and-agent configurations:

System or model configuration	Microsoft-reported CyberGym success rate
MDASH: MAI-Cyber-1-Flash + GPT-5.4	95.95%
GPT-5.5 Cyber	85.6%
Mythos 5	83.8%
GPT-5.6 Sol	83.6%
Gemini 3.5 Flash Cyber in CodeMender	83.2%

The MDASH configuration leads the next entry in Microsoft’s chart by more than ten percentage points.

Microsoft also says the configuration costs about 50% less than the previous strongest MDASH setup, which used GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.

The comparison is therefore about two dimensions:

1. Security performance.
2. The economics of running that performance continuously.

Security scanning is not a one-time question. Large organizations may need to inspect millions of lines of code, repeat scans after every change, validate suspected vulnerabilities, retest patches, and monitor a constantly changing software estate.

A configuration that is extremely capable but too expensive to run frequently may create less real protection than a slightly smaller model embedded in a better routing and validation system.

The More Important Number May Be 90%

Microsoft says MAI-Cyber-1-Flash was designed to handle up to 90% of the tasks inside the MDASH workflow.

The most difficult 10% can be routed to a larger model, which Microsoft identifies in the published configuration as GPT-5.4.

The strategy can be expressed as:

Common and frequent security tasks
→ MAI-Cyber-1-Flash

Exceptionally difficult tasks
→ GPT-5.4

This is not the same as saying that MAI-Cyber-1-Flash fixed 90% of vulnerabilities by itself.

The 90% figure refers to the share of tasks the small model is designed to cover within the routed workflow. The complete MDASH result still depends on the task router, the larger model, the specialized agents, validation, proof generation, deduplication, security tools, execution environments, and system-level controls.

The small model lowers the average cost of the workflow without removing the need for stronger models on the hardest cases.

MAI-Cyber-1-Flash Model Specifications

Microsoft describes MAI-Cyber-1-Flash as its first cybersecurity-specialized model.

The official model card lists:

Specification	MAI-Cyber-1-Flash
Architecture	Sparse Mixture of Experts Transformer
Total parameters	137B
Active parameters	5B
Context length	256K
Input	Text
Output	Text
Base model	MAI-Code-1-Flash
Primary environment	Microsoft codename MDASH
Release date	July 27, 2026
Availability	Azure AI Foundry Private Preview for approved MDASH customers

The model is a cybersecurity-specialized fine-tune of MAI-Code-1-Flash.

It was designed for workflows including vulnerability identification, validation, prioritization, triage, remediation support, and enterprise-scale code scanning.

It is not a general public cyber model.

Microsoft’s model card says access is restricted to selected MDASH customers and requires additional review because advanced cybersecurity capabilities are dual-use.

The model is also designed specifically for integration with MDASH, rather than as a standalone downloadable model or unrestricted public API.

Why a 5B-Active Model Can Carry Most of the Work

MAI-Cyber-1-Flash has 137 billion total parameters but activates approximately 5 billion for a token.

That sparse Mixture-of-Experts design gives the model access to a larger total capacity while keeping its active inference footprint relatively small.

The more important optimization, however, is specialization.

A general frontier model must support writing, mathematics, research, coding, conversation, planning, multimodal work, and tool use. A specialist model can focus more of its training and post-training on one operational domain.

For MAI-Cyber-1-Flash, that domain includes executable security environments and vulnerability-management workflows.

Specialization can improve price-to-performance when the model repeatedly encounters tasks similar to its training and evaluation environment.

The system still needs a fallback because difficult or unusual cases may exceed the specialist model’s capability.

This creates a practical multi-model architecture:

Low-cost specialist for breadth
+
Frontier model for exceptions
+
Verification system for trust

Replacing 80% of Model Calls Improved the System Score

The model card provides a particularly useful system-level comparison.

Microsoft says the previous MDASH configuration scored 88.4% on CyberGym.

After replacing 80% of the existing model calls in the workflow with MAI-Cyber-1-Flash, the result increased to 95.95%.

The cost also fell by about half relative to the previous strongest configuration.

This result challenges a common assumption:

A cheaper model must reduce quality.

That may be true when models are compared in isolation on the same task. It is not always true inside a routed system.

A specialist model may handle common tasks more consistently because it was trained for those tasks. A router can reserve the expensive frontier model for cases where it creates the most value.

The result depends on correctly answering three questions:

1. Which tasks should use the specialist?
2. Which tasks require the frontier model?
3. How should every result be verified?

Model routing becomes part of product quality.

The 95.95% Score Belongs to MDASH, Not the Small Model

Microsoft’s model card also reports standalone results for MAI-Cyber-1-Flash on other cybersecurity evaluations.

Those model-only results are not equivalent to the MDASH CyberGym score.

The model card lists:

Benchmark	Standalone MAI-Cyber-1-Flash result
CVEBench	0.314
CyberSecEval4 Threat Intelligence	0.553
CyberSecEval4 Malware Analysis	0.33
CRSBench	0.651 at POV=1200
ExploitGym Kernel	0
ExploitGym Userspace	0
ExploitGym Browser	0

These figures show why the system-level distinction matters.

The small model is not universally dominant across every cyber benchmark. Its strongest published result appears when it operates inside MDASH with other models, agents, tools, data, and validation stages.

This supports Microsoft’s central message:

The model is a component.
The system is the product.

What MDASH Does

MDASH is Microsoft’s multi-model, multi-agent vulnerability identification and remediation harness.

Microsoft says its security experts have created more than 100 specialized agents within the system.

Different agents can perform different parts of the workflow, including code targeting, candidate discovery, vulnerability reasoning, validation, proof construction, triage, deduplication, remediation, patch-related workflows, and comparison between findings.

A simplified system flow may look like this:

Code and security context
        ↓
Candidate-discovery agents
        ↓
Validation agents
        ↓
Debate and comparison
        ↓
Deduplication
        ↓
Proof-of-concept generation
        ↓
Patch or remediation support
        ↓
Human review and controlled action

The exact internal implementation is proprietary, but Microsoft has described several important design principles.

The Harness Is Model-Agnostic by Design

Microsoft says MDASH separates parts of the pipeline—such as targeting, validation, deduplication, and proof—from any one model.

That makes it easier to replace or compare models.

When a new model becomes available, the system can A/B test it against the current panel.

The organization’s earlier investments can remain useful:

• Scope files.
• Plugins.
• Configuration.
• Calibrations.
• Validation rules.
• Security workflows.

This reduces dependence on one model vendor or checkpoint.

It also makes continuous improvement possible. The best model for one stage may not be the best model for another.

Specialized Tools Extend Model Reasoning

Some vulnerabilities require more than reading source code.

A system may need to build the project, create a triggering input, run the vulnerable version, run the patched version, inspect a crash, query a code-analysis database, compare control flow, and verify whether the behavior is reproducible.

Microsoft says MDASH can use specialized domain plugins and code-analysis systems.

Its May announcement discusses a proving plugin for Common Log File System vulnerabilities and notes that CodeQL databases can also be used.

The model does not need to perform every operation through free-form text.

Tools can provide deterministic capabilities for tasks that are better handled by software.

Verification Is the Real Product Boundary

A security model can produce a plausible vulnerability description that is wrong.

If a system forwards every speculative result to a developer, it creates alert fatigue.

The operational value comes from proving that a finding is real.

Useful evidence may include:

• A reproducible crash.
• A proof-of-concept input.
• A failing test.
• A successful pre-patch execution.
• A failed post-patch execution.
• A precise code path.
• A validated affected version.
• A deduplicated report.
• A patch that passes testing.

This is why a benchmark such as CyberGym is relevant.

It does not score the persuasiveness of a written explanation alone.

It checks whether the generated proof can actually reproduce the target behavior.

What CyberGym Measures

CyberGym is a large-scale benchmark created by researchers associated with UC Berkeley.

The current public project includes 1,507 real-world vulnerability instances across 188 software projects.

For its primary PoC-generation setting, the agent receives:

1. A vulnerability description.
2. The corresponding pre-patch codebase.
3. An execution environment.

The agent must generate a proof-of-concept that triggers the vulnerability.

The benchmark then evaluates behavior against the vulnerable and patched versions.

A successful reproduction should generally satisfy the intended contrast:

Pre-patch version:
The PoC triggers the target vulnerability.

Post-patch version:
The same PoC no longer triggers the vulnerability.

CyberGym uses real vulnerabilities from major open-source projects, including projects from the OSS-Fuzz ecosystem.

Its execution-based structure makes it more rigorous than a benchmark that only asks a model to classify code or write an explanation.

What CyberGym Does Not Measure

The 95.95% number needs careful interpretation.

CyberGym’s primary setting gives the agent a vulnerability description.

The agent is not necessarily starting from a completely unknown repository with no clue that a vulnerability exists.

The benchmark therefore measures a form of known-vulnerability reproduction.

It does not directly mean:

• 95.95% of unknown vulnerabilities were discovered.
• 95.95% of all software vulnerabilities were repaired.
• The model can autonomously secure any codebase.
• The system has a 95.95% zero-day discovery accuracy.
• The system produces no false positives in production.

The benchmark still requires difficult work. The agent must navigate a real codebase, locate the relevant behavior, construct an effective trigger, build or execute the software, and verify the result.

The correct description is:

The reported score is a vulnerability-reproduction success rate on the CyberGym evaluation configuration used by Microsoft.

From 11.9% to 95.95%

The original CyberGym paper’s first version reported that the strongest tested combination, OpenHands with Claude 3.7 Sonnet, reached an 11.9% reproduction success rate.

Later benchmark revisions, agent frameworks, model generations, and system designs improved results substantially.

Microsoft’s reported 95.95% demonstrates how quickly the combination of models and harnesses has advanced.

However, the comparison should not be interpreted as a clean model-to-model improvement.

The systems differ in model generation, agent framework, prompting, tooling, validation, compute budget, cost, task routing, benchmark version, infrastructure, and retry policy.

The progress is real, but it is system progress.

The Public Leaderboard and Company-Reported Results

The source article notes that Microsoft’s 95.95% result was not yet reflected on the public CyberGym leaderboard at publication time.

Microsoft’s earlier May configuration, reported at approximately 88.4%–88.45%, had been publicly presented as the benchmark leader.

The new 95.95% figure is published by Microsoft in the MAI-Cyber-1-Flash announcement, the model card, and Microsoft’s Project Perception announcement.

Until an external leaderboard entry or independent reproduction is available, it should be described as a Microsoft-reported result.

This does not make the result meaningless. It means readers should distinguish:

Vendor-reported evaluation
from
independently reproduced public result

That distinction is especially important in fast-moving benchmark comparisons.

Data Is the Hardest Layer to Copy

Microsoft identifies historical security data as its deepest advantage.

The company says it processes more than 100 trillion security signals per day and has operational insight from 1.6 million customers.

Its security visibility spans identity, endpoints, cloud, networks, data, browsers, and applications.

The value is not simply the number of events.

The company can connect security actions with outcomes:

• Which vulnerabilities were exploitable.
• Which attacks were contained.
• Which detections were false.
• Which mitigations worked.
• Which patches solved the issue.
• Which configurations reduced risk.

This creates a feedback loop.

Security event
→ investigation
→ validation
→ remediation
→ observed outcome
→ better data and rewards
→ improved models and agents

A competing company can obtain access to similar foundation models.

It cannot instantly recreate decades of validated operational history.

Data Volume Is Not Enough by Itself

Large data volume is only useful when it is transformed into training, evaluation, and operational context.

Raw security signals can be repetitive, noisy, incomplete, customer-specific, sensitive, incorrectly labeled, biased toward visible attacks, or missing the final outcome.

The data pipeline must connect events to trustworthy labels and outcomes.

For example:

Alert raised
→ analyst investigated
→ vulnerability confirmed
→ patch deployed
→ exploit no longer works

That sequence is more valuable than the alert alone.

The moat comes from data plus curation, feedback, evaluation, and secure operational access.

Model, Data, and Harness

Microsoft’s three-part framework provides a useful way to evaluate any enterprise AI security system.

Model

Questions include:

• Which models are used?
• How are they specialized?
• What is the latency?
• What is the token cost?
• Which tasks require a larger model?
• What are the safety limitations?

Data

Questions include:

• What security context is available?
• How recent is it?
• How is it labeled?
• Does it include validated outcomes?
• Is it customer-specific?
• How are privacy and permissions handled?
• How is data quality measured?

Harness

Questions include:

• How are tasks decomposed?
• How are models routed?
• How are tools called?
• How are findings verified?
• How are duplicates removed?
• When is a human required?
• How are failures audited?
• Can the model be replaced without rebuilding the system?

A strong model with weak data and no verification may generate impressive but unreliable reports.

A well-designed system can make a smaller model more useful by assigning it the correct tasks and checking its work.

The Economics of Always-On Security

Microsoft argues that token cost becomes a central constraint when security scanning runs continuously.

Consider a simplified workload:

10 million code-analysis tasks per month

If every task uses the most expensive frontier model, the system may become difficult to operate at full coverage.

A routed design changes the average cost:

90% lower-cost specialist
+
10% expensive frontier model

The actual economics also depend on input length, output length, tool calls, retries, sandbox execution, code indexing, validation, human review, infrastructure, and data storage.

The model token bill is only one component.

Still, routing creates a powerful optimization opportunity because the expensive model is used selectively.

Why the Best Model May Not Produce the Best System

A benchmark can compare individual models under a common harness.

A product needs to optimize the complete workflow.

The best system may use a model that is not individually ranked first if it offers better speed, cost, specialization, predictability, tool use, context efficiency, safety calibration, and compatibility with the harness.

This is similar to other production systems.

A database does not choose one algorithm for every query. A cloud scheduler does not place every workload on the largest machine. A security system should not send every task to the most expensive model.

Safety and Restricted Availability

Cybersecurity models create unusual safety risks.

The same capability that helps a defender validate a vulnerability may help an attacker exploit one.

Microsoft has therefore limited access to MAI-Cyber-1-Flash.

The model card says:

• It is available through Azure AI Foundry Private Preview.
• It is intended only for MDASH.
• Access is restricted to selected customers.
• Additional approval is required.
• Defensive workflows are in scope.
• Use outside defensive security operations in MDASH is out of scope.

Microsoft says the model was calibrated with a security-first approach, evaluated by the Microsoft AI Red Team, tested through automated adversarial exercises, tested by security experts, and assessed by an independent third party.

The independent assessment reportedly found no critical-severity issues.

That does not prove the model is risk-free. It explains why the company is beginning with a restricted deployment rather than an unrestricted public release.

Known Model Limitations

Microsoft’s model card lists several limitations.

Language Performance

The model was primarily trained and evaluated in English. Performance may be lower in other languages.

Incorrect Outputs

Like other language models, it may produce inaccurate, incomplete, or incorrect code and text. Outputs require review and validation.

Conservative Safeguards

The model is intentionally calibrated to be cautious. Safeguards may activate when a legitimate defensive request is ambiguous or resembles harmful activity.

System Dependence

The model is designed for MDASH. Standalone results do not represent the full system’s capability.

Limited Scope

Use outside approved defensive security operations is not supported.

MDASH Is More Than a Benchmark System

Microsoft’s May MDASH announcement includes examples from actual security research.

The company reported testing the harness on an unpublished sample driver containing 21 deliberately inserted vulnerabilities. It said MDASH identified all 21 in that controlled test with zero false positives.

Microsoft also reported that MDASH contributed to the identification of 16 CVEs included in a May 2026 Windows Patch Tuesday release.

These are Microsoft’s own product and research claims.

They are more relevant to deployment than a benchmark score because they involve private code, real engineering workflows, vulnerability validation, patch processes, and security-team review.

At the same time, selected case studies do not establish a universal false-positive rate or success rate across every codebase.

From Security Copilot to Security Action Systems

Microsoft introduced Project Perception as a larger agentic security system.

Its objective is to move from AI that assists a defender to AI that performs more of the security workflow while leaving critical judgment under human control.

Project Perception coordinates three classes of agents:

Agent class	Main role
Red agents	Simulate attacker thinking and identify possible paths to compromise
Blue agents	Investigate, reason over context, detect, and triage meaningful risks
Green agents	Remediate, harden systems, and reduce exposure

The three roles form a loop:

Red agent finds a path
→ Blue agent validates and prioritizes it
→ Green agent remediates it
→ System observes the outcome
→ Future defense improves

Microsoft says Project Perception entered public preview on August 3, 2026.

The Project Perception Stack

Microsoft describes the system as several connected layers.

Signals and Sensors

The system observes endpoints, identities, clouds, applications, and other parts of the digital estate.

Security Context

Raw signals are transformed into a connected representation of assets, identities, relationships, policies, risks, activities, and historical incidents.

Models

The platform uses a multi-model strategy, including specialized cyber models such as MAI-Cyber-1-Flash.

Harness

The harness coordinates models, agents, tools, workflows, testing, permissions, and controls.

Agents

Red, blue, and green agents perform specialized security work.

Actuators

Actuators translate decisions into actions within integrated security products.

This architecture is broader than a chatbot. It is intended to form a continuous security operating system.

Humans Remain Responsible for Critical Decisions

Microsoft explicitly says that humans remain in control of high-impact actions.

Its Project Perception page frames the division as:

Agents carry the work.
Humans carry the judgment.

Defenders set objectives, policies, guardrails, approval requirements, scope, and response priorities.

High-impact actions remain subject to human sign-off.

This is necessary because security remediation can itself cause harm.

An automated system might disable a legitimate account, block production traffic, remove a critical file, quarantine a business system, deploy a flawed patch, or interrupt operations.

The cost of a false action can be higher than the cost of a missed alert.

Project Perception and Security Copilot Are Different

Microsoft describes Security Copilot as an AI-assisted conversational interface.

Project Perception is presented as the wider agentic system.

Product concept	Role
Security Copilot	AI that assists through a generative interface
Project Perception	AI agents that continuously reason and act across security workflows

The products are intended to work together.

A human may use Copilot to understand and direct work, while Perception agents perform more of the ongoing operational process.

Consumption-Based Pricing

Microsoft says Project Perception uses consumption-based pricing measured in Security Compute Units, or SCUs.

Different agents consume different amounts depending on the intensity of the task.

This makes model and workflow efficiency economically important.

A red-team simulation, a quick triage task, and a long remediation workflow may consume different resources.

The multi-model routing strategy used in MDASH fits this broader pricing model.

If routine work can be handled by a smaller specialized model, more security coverage may be delivered for the same budget.

Verification May Become the Strongest Moat

Access to frontier models is becoming less exclusive.

Organizations can increasingly call capable public models through APIs.

The scarce part may be the system that can determine whether a model’s security claim is true.

That system needs executable environments, build infrastructure, version control, proof generation, patch comparison, security knowledge, sandboxing, deduplication, human review, and evidence tracking.

In security, a polished explanation without evidence is often not enough.

The moat moves from:

Access to a powerful model

toward:

A trusted process that validates and operationalizes the model's work

What Security Teams Should Learn from MDASH

1. Route Tasks by Difficulty

Do not automatically use the most expensive model for every operation.

Build an evaluation set and determine which tasks can be handled reliably by a smaller specialist.

2. Separate Discovery from Validation

One agent or model can generate candidates. A different agent, tool, or deterministic test should validate them.

3. Require Executable Evidence

Where possible, require a reproducible test rather than accepting a textual claim.

4. Preserve Human Approval for Consequential Actions

Automate collection, analysis, and verification first. Keep destructive or production-changing actions behind approval gates.

5. Measure Cost per Validated Finding

Token price alone is not the correct metric.

A cheap model that produces many false positives can be more expensive operationally.

Useful metrics include cost per confirmed vulnerability, time to validation, false-positive rate, human-review time, patch acceptance rate, and regression rate.

6. Build a Model-Agnostic Harness

Model generations change quickly.

Keep task definitions, tools, validations, and security controls reusable when the underlying model changes.

7. Treat Security Data as a Feedback System

Record outcomes, not only alerts.

The system should learn which findings were real and which remediations worked.

8. Test in Isolated Environments

CyberGym’s repository warns against exposing its services to the public internet.

Microsoft also describes sandboxed, network-isolated environments for testing.

Vulnerability reproduction should run in controlled infrastructure.

How to Evaluate an AI Vulnerability System

A serious evaluation should include more than one headline score.

Detection and Reproduction

• Can the system identify relevant code?
• Can it generate a working proof?
• Does the proof distinguish pre-patch and post-patch behavior?

False Positives

• How many findings fail verification?
• How much human time is spent reviewing them?

Coverage

• Which languages are supported?
• Which project types are supported?
• Which vulnerability classes are handled?

Cost

• What is the cost per repository?
• What is the cost per million lines?
• What is the cost per confirmed vulnerability?

Latency

• How long does scanning take?
• How long does validation take?
• Can the system fit inside CI workflows?

Remediation

• Can the system propose a patch?
• Does the patch compile?
• Do tests pass?
• Does the patch introduce regressions?

Security

• Is code isolated?
• Is the execution environment network-restricted?
• Are secrets protected?
• Are actions auditable?

Human Control

• Which actions require approval?
• Can the full reasoning and evidence be replayed?
• Can a reviewer reject or modify a recommendation?

Important Limits on the Headline Result

The 95.95% score is important, but it should not be generalized beyond the evidence.

It Is a System Result

MDASH, several agents, two model tiers, tools, and data produced the result.

It Is Vendor-Reported

Microsoft published the result. Independent reproduction remains valuable.

It Is Benchmark-Specific

CyberGym measures a defined vulnerability-reproduction task.

It Does Not Eliminate False Positives

Production false-positive behavior requires separate measurement.

It Does Not Mean Full Autonomy

Microsoft retains human sign-off for critical actions.

It Does Not Mean the Model Is Public

MAI-Cyber-1-Flash is restricted to approved MDASH customers in private preview.

It Does Not Prove Universal Superiority

Results can vary across languages, vulnerability classes, codebases, tools, and benchmark harnesses.

常见问题

What is Microsoft MDASH?

MDASH is Microsoft’s multi-model, multi-agent system for identifying, validating, prioritizing, and remediating software vulnerabilities. It combines specialized agents, multiple models, code-analysis tools, proof generation, validation, and enterprise security controls.

What is MAI-Cyber-1-Flash?

MAI-Cyber-1-Flash is Microsoft’s cybersecurity-specialized sparse MoE model. The official model card lists 137 billion total parameters, 5 billion active parameters, a 256K context window, and restricted availability inside MDASH through Azure AI Foundry Private Preview.

Did MAI-Cyber-1-Flash score 95.95% by itself?

No. The 95.95% result belongs to the complete MDASH configuration using MAI-Cyber-1-Flash, GPT-5.4, agents, tools, data, and validation. Microsoft’s standalone model-card results are different and lower on several other cyber benchmarks.

What does the 90% figure mean?

Microsoft says MAI-Cyber-1-Flash was designed to handle up to 90% of tasks in the routed MDASH workflow. It does not mean the model independently discovered or repaired 90% of all vulnerabilities.

What does CyberGym measure?

CyberGym primarily evaluates whether an agent can generate a proof-of-concept that reproduces a known real-world vulnerability using a vulnerability description and the pre-patch codebase. The PoC is tested against vulnerable and patched versions.

Is the 95.95% result independently verified?

The score is published by Microsoft in its announcement and model card. At the time described by the source article, it had not yet appeared as the updated result on the public benchmark leaderboard, so it should be described as Microsoft-reported.

Can developers download MAI-Cyber-1-Flash?

No public model download is documented. Microsoft says it is available only to selected MDASH customers through Azure AI Foundry Private Preview and subject to review and approval.

What is Project Perception?

Project Perception is Microsoft’s wider agentic security system. It coordinates red agents, blue agents, and green agents across detection, investigation, remediation, and hardening workflows while keeping humans responsible for critical decisions.

相关工具

• CyberGym: The official open-source benchmark for evaluating AI agents on real-world vulnerability-reproduction tasks.
• Microsoft CodeQL: A semantic code-analysis engine that can query codebases for security-relevant patterns and data flows.
• PyRIT: Microsoft’s open-source Python Risk Identification Toolkit for red-teaming generative AI systems.
• Microsoft Foundry: Microsoft’s enterprise platform for building, evaluating, and governing AI models and agents.
• OpenHands: An open-source software-development agent used in the original CyberGym research evaluations.
• OSS-Fuzz: Google’s continuous fuzzing infrastructure for open-source software and a source of vulnerability data used by CyberGym.

Related Links

• Introducing MAI-Cyber-1-Flash Inside MDASH: Microsoft’s official announcement covering the model-routing strategy, 95.95% result, cost reduction, and Model–Data–Harness framework.
• MAI-Cyber-1-Flash Model Card: Official specifications, access conditions, limitations, safety approach, and benchmark details.
• MDASH Launch Article: Microsoft’s technical overview of the harness, validation architecture, security research, and initial CyberGym result.
• Project Perception Announcement: Microsoft’s explanation of the red, blue, and green agent system and the new cyber stack.
• Project Perception Product Page: Official capabilities, governance model, pricing approach, and relationship with Security Copilot.
• CyberGym Research Paper: The research paper describing the benchmark, tasks, data, and original evaluation results.
• CyberGym GitHub Repository: Installation, dataset, evaluation, submission, firewall, and local-deployment guidance.

Summary

Microsoft reports that MDASH reached a 95.95% success rate on CyberGym after integrating MAI-Cyber-1-Flash and routing the hardest cases to GPT-5.4. The company also reports a 50% cost reduction compared with its earlier strongest model configuration.

The result does not belong to one model. It comes from a multi-model security system with more than 100 agents, historical security data, specialized tools, proof generation, validation, deduplication, sandboxing, and human-designed orchestration.

CyberGym mainly tests reproduction of known vulnerabilities from descriptions and pre-patch code. The score is therefore evidence of strong vulnerability-reproduction performance on that benchmark, not a universal zero-day discovery or autonomous-remediation rate.

Project Perception extends the same system philosophy beyond code scanning: red agents expose risks, blue agents investigate them, and green agents remediate them, while critical decisions remain under human control.

The central lesson is that frontier cybersecurity advantage is shifting from access to one powerful model toward the ability to route, verify, and operationalize many models inside a trusted security system.