www.it-connect.fr
Microsoft Unveils MAI-Cyber-1-Flash and Project Perception for Cybersecurity
96% success on the CyberGym benchmark, at roughly half the cost. That was the argument Microsoft put on the table on Monday, July 27, 2026, when it introduced MAI-Cyber-1-Flash, its first in-house AI model fully dedicated to cybersecurity, as well as Project Perception, an autonomous agent system expected in public preview on August 3. Two announcements, one guiding idea: defense must run continuously, powered by AI.
MAI-Cyber-1-Flash: the small model that does 90% of the work
Last June, Microsoft unveiled MAI-Thinking-1, its first AI reasoning model. Now, the Redmond company wants to go further with MAI-Cyber-1-Flash, a compact model focused on code and cybersecurity, derived from the MAI-Thinking-1 lineage. It does not work alone: it is integrated into MDASH, Microsoft’s multi-agent vulnerability discovery system unveiled in May 2026. The role split is as follows: this new model handles up to 90% of tasks, and the remaining 10%, deemed too complex, are routed to OpenAI’s GPT-5.4 model.
What is especially striking in Microsoft’s announcement is the fact that this small model would be able to reach a score of 95.95% on CyberGym, a public benchmark made up of 1,507 real-world vulnerability reproduction tasks. That is a very high score, and even 12 points ahead of Anthropic’s Claude Mythos. For reference, MDASH claimed 88.45% on the same test last May. Even more notably, this combination would be around 50% cheaper than the best previous MDASH configuration. That setup relied on a combination of GPT-5.4, 5.4 mini, and 5.3 codex.
This should still be taken with caution: these are internal tests conducted by Microsoft, even though this benchmark is being cited more and more often.
So, what is Microsoft’s secret recipe? In reality, here is how the Redmond company went about it:
- The model, trained in-house.
- The data, presented as the decisive advantage: more than 100 trillion security signals per day and a history of exploits and remediation drawn from 1.6 million customers (so that is what our data is for).
- The harness, MDASH, orchestrating more than 100 agents built by the internal FORGE team.
Project Perception: red, blue, and green agents
The second part is Project Perception. This one goes beyond vulnerability hunting. The system coordinates three families of specialized agents that execute playbooks:
- Red agents: they map possible attack paths before an attacker can use them, with reconnaissance and penetration testing included. Red, as in Red Team, basically.
- Blue agents: they investigate, correlate context, prioritize what constitutes a real risk, and generate new detection rules. The Blue Team.
- Green agents: they produce and deploy fixes, all the way to opening a pull request on GitHub or pushing a blocking rule to a WAF.
Microsoft laid out a complete scenario: a threat intelligence report arrives about a new attacker group, complete with its indicators of compromise and TTPs. An analyst then asks Perception whether their organization is exposed to this cybercrime group.
The system then takes over to carry out a set of tasks: it maps the assets that could be targeted, launches a penetration-testing agent against those assets, sorts the reported vulnerabilities according to the group’s playbook, generates the corresponding detection rules, and then proposes a remediation plan. According to David Weston, CVP at Microsoft Security, this represents hours of manual work spread across several specialists, versus a fix obtained in just minutes thanks to Project Perception. Seen that way, it is pretty wild.
In its article, Microsoft mentions a public preview starting on August 3, 2026, initially within Microsoft Defender. But be careful: this new service would be offered as usage-based billing expressed in Security Compute Units.
