Skip to content

Did Microsoft Really Beat Mythos? Checking MAI-Cyber-1-Flash's 95.95% CyberGym Score

What 95.95% establishes—and what it does not

Supported by the public materialsNot established by the public materials
An MDASH configuration scored 95.95% on CyberGymMAI-Cyber-1-Flash alone is stronger than Mythos 5
Microsoft's chart puts Mythos 5 about 12 points behindThe result leads the public leaderboard under identical conditions
Level 1 reproduced known vulnerabilities with working PoCsUnknown-vulnerability discovery and patch correctness also score 95.95%
Microsoft reports 50% lower cost than its current MDASH mixThe product always costs half as much as competing systems

Microsoft announced its cybersecurity model MAI-Cyber-1-Flash and the agentic security system Project Perception on July 27, 2026.12 Project Perception is scheduled to enter public preview on August 3.

The headline result is a 95.95% CyberGym success rate for MDASH using MAI-Cyber-1-Flash and GPT-5.4, about 12 points above Anthropic's Mythos 5 in Microsoft's comparison. The 95.95% belongs to the complete MDASH system, not to MAI-Cyber-1-Flash in isolation. The evaluated task also reproduces described, known vulnerabilities; it is not blind discovery of unknown bugs.

MDASH routing and the ownership of the 95.95% CyberGym result

Only 5 billion of 137 billion parameters are active

MAI-Cyber-1-Flash is a cybersecurity fine-tune of the coding model MAI-Code-1-Flash. Its model card specifies a sparse mixture-of-experts transformer, 137 billion total parameters, 5 billion active parameters, a 256,000-token context window, and text input and output.3

The lineage begins with a MAI-Thinking-1 mid-training checkpoint. Microsoft says MAI-Code-1-Flash then underwent supervised fine-tuning, an additional phase using roughly two million synthetic agentic tasks, and reinforcement learning across more than 150,000 environments.4 It is therefore more precise to describe MAI-Cyber-1-Flash as the result of successive reasoning, coding, and security specialization than as a directly compressed MAI-Thinking-1.

There is no generally available standalone API. Approved MDASH customers can access it only inside MDASH through an Azure AI Foundry private preview.3

MDASH's staged pipeline supports the 95.95% result

MDASH is a multi-model execution harness for vulnerability discovery and remediation, not a model name. Microsoft organizes more than 100 specialized agents into five stages.5

StageWhat MDASH does
PrepareIngests the codebase and builds an attack-surface and threat model
ScanAuditor agents produce vulnerability candidates and evidence
ValidateA separate cohort contests reachability and exploitability
DedupeSemantically equivalent candidates are merged
ProveTriggering inputs are generated and executed when the bug class permits

For C and C++, the Prove stage can use AddressSanitizer to test whether an input triggers invalid memory access. Disagreement between an auditor and a debating agent also becomes a signal for further validation. This is why Microsoft vice president of agentic security Taesoo Kim described the model as one input and the system around it as the product.56

The new model card reports that replacing 80% of MDASH's existing models with MAI-Cyber-1-Flash raised CyberGym performance from 88.4% to 95.95%, a 7.55-point increase.3 That gain passed through MDASH's exploration, contest, deduplication, and dynamic proof stages; it cannot be attributed to model weights alone.

The 90-to-10 routing policy drives the cost claim

Microsoft says MAI-Cyber-1-Flash can handle up to 90% of tasks, with the exceptionally difficult 10% routed to GPT-5.4.1 The 90% figure is a share of tasks. The model card's separate 80% figure is the share of existing models replaced in MDASH. They do not use the same denominator.

Microsoft reports that this configuration cuts cost by 50% relative to its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.1 Using a specialized, smaller model on the default path and reserving an expensive model for difficult cases makes the mechanism plausible.

The public materials do not disclose token use, model-call volume, latency, workload composition, or compute allocation. The 50% reduction cannot yet be independently reproduced or normalized against another vendor's system. An enterprise proof of concept should measure cost and elapsed time per validated vulnerability, not only the price of one scan.

CyberGym Level 1 measures reproduction of known bugs

CyberGym contains 1,507 benchmark instances from 188 open-source projects, derived from vulnerabilities found through OSS-Fuzz.7 On Level 1, which the public leaderboard uses, an agent receives a vulnerability description and the unpatched code. It succeeds by generating a working proof of concept that triggers on the pre-patch version but not on the post-patch version.

This setting measures whether a system can navigate a large codebase and craft an input for a described flaw. The 95.95% result does not directly measure:

  • blind discovery when no vulnerability description is supplied;
  • precision among a broader set of candidate findings;
  • generation of a safe patch without regressions; or
  • success on a company's private code and build environment.

The CyberGym researchers separately ran open-ended experiments against current codebases.7 CyberGym as a research program does address unknown bugs, but that separate work should not be conflated with the Level 1 leaderboard score reported here.

Microsoft's chart and the public leaderboard do not match

Microsoft's chart places MDASH with MAI-Cyber-1-Flash and GPT-5.4 at 95.95%. The four compared Mythos 5, Gemini 3.5 Flash Cyber, and GPT-based configurations range from 83.2% to 85.6%.1 Mythos 5 is reported at 83.8%, making Microsoft's "12-point" lead a rounded comparison.8

The public CyberGym leaderboard did not list the 95.95% result when checked on July 28. Microsoft's listed submission remained the May 12 MDASH result at 88.4%, and Microsoft's materials do not say whether the new result was submitted.9

Wiz also announced on July 27 that its agentic system Atlas had reached 90.9% and ranked first on the public leaderboard.10 Atlas is absent from Microsoft's comparison chart. The arithmetic difference from 95.95% is 5.05 points, but Microsoft's trial count and completion of the same submission process are not public, so the two numbers should not be presented as a verified like-for-like comparison.

The evidence supports the narrower sentence: Microsoft's internal evaluation chart puts its MDASH configuration about 12 points above Mythos 5. It does not support the claim that an independently verified public leaderboard ranks the configuration first.

June's 96.55% used a different success condition

Microsoft reported a 96.55% CyberGym result for MDASH in June. That figure counted any crash, including crashes outside the target vulnerability.6

The July announcement and model card do not state that the 95.95% figure uses the same "any crash" condition. The two numbers cannot show either a decline from 96.55% or a model-driven regression. Putting them on one performance trend would turn a change in scoring conditions into a false change in capability.

Model-only scores evaluate different capabilities

The model card also reports MAI-Cyber-1-Flash results under a lightweight terminal harness.3

BenchmarkMAI-Cyber-1-Flash alone
CVEBench0.314
CyberSecEval4 Threat Intelligence0.553
CyberSecEval4 Malware Analysis0.33
CRSBench0.651 (POV=1200)
ExploitGym Kernel / Userspace / Browser0 / 0 / 0

These tasks, scales, and harnesses differ from CyberGym, so they should not be placed beside 95.95% as one ranking. ExploitGym asks an agent to turn a supplied vulnerability and crashing input into a practical code-execution exploit. Zeros across all three categories provide no basis for calling the standalone model a universal cyber model that surpasses frontier systems.

The model card also documents a cautious initial calibration whose safeguards may intervene more often for ambiguous or apparently offensive requests. Public results cannot separate safety refusals from underlying capability as the cause of a low score. All benchmark testing took place in an environment isolated from production systems, the public internet, and external services.3

Enterprise evaluations need four conditions from vendors

Project Perception coordinates red-team, blue-team, and green-team agents, with MAI-Cyber-1-Flash inside MDASH as its first announced scenario.2 The competitive field is moving quickly: Google announced Gemini 3.5 Flash Cyber on July 21; Anthropic limits Mythos 5 to a small set of Project Glasswing partners; and OpenAI expanded Daybreak on June 22 around Codex Security and GPT-5.5-Cyber.111213

Evaluation conditions should come before product names.

  1. Vendors identify who owns the score. They separate a standalone model, a model with tools, and a multi-model product.
  2. Vendors disclose the success condition and trial count. Target reproduction, any crash, and unknown-vulnerability discovery are not interchangeable.
  3. Adopters reproduce the workflow on their own code. They measure validated findings, false positives, and time to a completed fix.
  4. Adopters compare cost per outcome. They record total cost through validation and remediation, not only token prices.

The announcement does not show a small model defeating Mythos 5 by itself. It shows that, in Microsoft's evaluation environment, a specialized model on the high-volume path, frontier-model escalation for difficult cases, and a harness that contests and executes findings produced high success at lower reported cost.

Post on X Copy link

  1. Microsoft AI, Introducing MAI-Cyber-1-Flash inside MDASH, July 27, 2026. ↩↩↩↩

  2. Microsoft, Rethinking security for the age of AI, July 27, 2026. ↩↩

  3. Microsoft AI, MAI-Cyber-1-Flash Model Card, July 27, 2026. ↩↩↩↩↩

  4. Microsoft AI, MAI-Code-1-Flash Model Card, accessed July 29, 2026. ↩

  5. Microsoft Security, Defense at AI speed, May 12, 2026. ↩↩

  6. Microsoft Security, Beyond the benchmark: Advancing security at AI speed, June 17, 2026. ↩↩

  7. CyberGym, Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale, accessed July 29, 2026. ↩↩

  8. Neowin, Microsoft's MDASH beats Anthropic's Mythos 5 with new in-house cybersecurity model, July 27, 2026. Used as a secondary source for the individual value in Microsoft's chart. ↩

  9. The Hacker News, Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost, July 28, 2026. Used for its same-day snapshot of the public leaderboard. ↩

  10. Wiz, Atlas: Wiz's autonomous AI Agent for vulnerability research, July 27, 2026. ↩

  11. Google, 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber, July 21, 2026. ↩

  12. Anthropic, Claude Mythos 5, accessed July 29, 2026. ↩

  13. OpenAI, Daybreak: Tools for securing every organization in the world, June 22, 2026. ↩