{
  "id": 72146,
  "title": "Microsoft relies 90 percent of its bug hunting on a mini-model",
  "url": "https://urgent.news/2026/08/03/microsoft-confie-90-de-sa-chasse-aux-failles-a-un-mini-modele",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-03T06:00:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/thibault_monteiro/microsoft-confie-90-de-sa-chasse-aux-failles-a-un-mini-modele-2m6l"
  },
  "original_language": "fr",
  "account": "The main thing Microsoft presented on July 27, MAI-Cyber-1-Flash, a compact model derived from its in-house reasoning model MAI-Thinking-1 and designed to detect software vulnerabilities. Associated with GPT-5.4 in the multi-agent harness MDASH, it reaches 95.95% on the CyberGym benchmark compared to 88.45% in May, absorbs up to 90% of common security tasks, and halves the costs of configuration in production. Project Perception, the red, blue, and green agent platform that exploits this device, enters public preview on August 3 in Microsoft Defender, billed by consumption in Security Compute Units.\n\nMicrosoft made two announcements on the same day, and they respond to each other. On one side, a tiny model trained for a single task. On the other, a platform of agents supposed to maintain a defense posture continuously. Between the two, an architectural decision that goes far beyond the publisher: stop sending each line of code to an expensive generalist. A cheap specialist facing an expensive generalist MAI-Cyber-1-Flash derives from MAI-Thinking-1, the reasoning model that Microsoft presented in June with six other internal models.\n\nVersion compact and inexpensive to run, it was trained on attack and patch data that the publisher's security teams have accumulated over the years. It does not work alone: it is inserted into MDASH, the multi-agent harness of the company (the software framework that orchestrates the agents and chains their steps), unveiled in May. Microsoft assumes this distribution of roles without hesitation. The generalist knows almost everything and charges for each call accordingly; the vertical model only knows how to do one thing, but it repeats it for much less.\n\nConcretely, MAI-Cyber-1-Flash takes up to 90% of common security tasks, and GPT-5.4 only intervenes on the 10% of the most twisted cases. The publisher claims a bill reduced by half compared to the MDASH configuration currently in production. Competitors have taken the other path: Google DeepMind runs CodeMender, its code correction agent, on its Gemini models, and Anthropic has built its Claude Security offer on its generalist models.\n\nThis is the arbitration that will be replayed everywhere: pay a universal model for repetitive work or train a narrow model and keep the big caliber for the handful of cases that resist. Security has what other professions lack If vertical models first appear here, it's not a coincidence of calendar. Vulnerability detection brings together the three conditions that other domains almost never have together: a deposit of proprietary data (decades of found and corrected flaws), an enormous volume of quasi-identical tasks, and above all a mechanical judge.\n\nAn exploit works or does not work. This verifiability weighs as much on training as on evaluation. A specialized model in commercial writing or legal analysis remains condemned to human judgment, therefore to slow and debatable progress. A security model, on the other hand, corrects itself against evidence. This is what makes cybersecurity the first market where the bet of the small professional model holds economically, and not just on paper.\n\nThe score increases, the noise remains out of the field The MDASH pipeline orchestrates more than a hundred specialized agents in several steps: preparation, scan, contradictory debate between agents, duplicate removal, then proof of exploitability. On CyberGym, the benchmark of reference for the detection of real vulnerabilities in open-source code, the whole increases from 88.45% in May to 95.95% with the new model.\n\nAccording to Microsoft's measurements, this places it a dozen points ahead of Claude Mythos from Anthropic. This percentage counts the flaws that the system finally finds. It does not count those that it believes to see where there are none. However, the two most interesting steps of the pipeline, the contradictory debate and the proof of exploitability, exist precisely to extinguish false alerts.\n\nThese two safeguards designate the main adversary, noise, which no public figure quantifies for now. The question becomes serious as soon as an agent acts without review. A false alert in a dashboard costs a few minutes of analyst. A corrective applied automatically on a false alert touches production code. Setting the tolerance threshold is therefore deciding whether the loop can be closed without you.\n\nRed, blue, green: agents work, humans sign Project Perception distributes three roles. Red agents simulate attacks like an assailant seeking an open door. Blue agents detect threats and prioritize them by severity. Green agents apply patches and close breaches. High-impact actions remain subject to human validation, and Microsoft defends this line of demarcation: workload to agents, strategic decisions to teams.\n\nThe formula is reassuring, with one reservation: the boundary of \"high impact\" is defined by the platform, not by you. Everything that falls below is executed silently. The economic model adds a second tension, less discussed. Billing is done by consumption, in Security Compute Units (security calculation units billed by usage) whose volume depends on the intensity of the tasks executed.\n\nA zealous agent that multiplies scans becomes a budget line, and cost optimization ends up arbitrating the depth of analysis. Test on your code, not on the benchmark The public opening starts on August 3 in Microsoft Defender, before a gradual deployment to the rest of the security range. If you get your hands on it, don't replay the public test: measure on your own code base how many alerts are triggered.",
  "summary": "Microsoft unveiled on July 27 MAI-Cyber-1-Flash, a compact model derived from its in-house reasoning model MAI-Thinking-1 and designed to identify software vulnerabilities. Paired with GPT-5.4 in the MDASH multi-agent harness, it achieves 95.95% on the CyberGym benchmark compared to 88.45% in May, absorbs up to 90% of common security tasks, and halves the...",
  "key_points": [
    "Microsoft unveils compact model MAI-Cyber-1-Flash for software vulnerability detection.",
    "MAI-Cyber-1-Flash achieves 95.95% on CyberGym benchmark, up from 88.45% in May.",
    "Project Perception platform with red, blue, and green agents enters public preview on August 3."
  ],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/72146.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}