Microsoft Cuts Security Agent Costs in Half, but GPT-5.4 Still Handles the Hard 10%

Microsoft announced MAI-Cyber-1-Flash on July 27, a small model built to do one job: find vulnerabilities in large codebases. It branches off the company's in-house MAI-Thinking-1 reasoning line and is the first model Microsoft has trained specifically for security work.

The more useful part of the announcement is not the model but where Microsoft placed it. MAI-Cyber-1-Flash runs alongside OpenAI's GPT-5.4 inside MDASH, a multi-agent harness for vulnerability discovery and repair. Better results at half the price is the pitch for that pairing.

The bill, split 90/10

Cost did not fall because the model got bigger. It fell because the work got divided.

MDASH routes incoming tasks by difficulty. MAI-Cyber-1-Flash takes up to 90% of them, and only the 10% the small model cannot close moves to GPT-5.4. The previous MDASH configuration mixed three models, GPT-5.4, GPT-5.4 mini, and GPT-5.3 codex. Against that baseline, Microsoft reports a 50% cost reduction.

The question this structure answers is not whether Microsoft has moved off OpenAI. The hardest 10% still runs on GPT-5.4. What Microsoft reduced is call volume, not dependence. The in-house model was not slotted in to replace a frontier model; it was slotted in front of one, as a filter that decides which requests are worth the expensive call.

Teams that operate agent harnesses will recognize the arithmetic. The monthly bill is set less by per-token price than by which requests go to which model. What Microsoft published here is that routing rule frozen into a shipping product, with numbers attached.

MDASH itself runs more than 100 agents across multiple models. Enterprise controls ship with it:

• Role-based access control and tenant isolation
• Encryption and audit logs
• Code execution restricted to sandboxes with no internet access

What 95.95% on CyberGym does and does not prove

The performance case rests on a single benchmark. CyberGym, published by UC Berkeley in June 2025, is built from 1,507 real vulnerabilities surfaced by OSS-Fuzz across 188 open source projects. The task is narrow: given a pre-patch codebase snapshot and a description of the vulnerability, produce a proof of concept that actually triggers it.

The figures from Microsoft's chart:

Microsoft AI CEO Mustafa Suleyman said the configuration "beats Gemini, GPT-5.5 Cyber, GPT-5.6 Sol, and Mythos 5 on CyberGym," and added that Microsoft is "putting this straight into production."

All of these numbers are vendor-measured. There is no independent verification, and the evaluation configuration was not disclosed. The Register raised the same objection the day of the announcement: the only basis for the comparison is Microsoft's internal testing. CyberGym varies in difficulty depending on how much information the agent is given, and the best agent success rate reported in the June 2025 paper was 11.9%. A jump to 95.95% in about a year needs to be split between model improvement and changed evaluation conditions, and the published material does not allow that split.

The comparison set is worth reading closely too. Only Microsoft's own entry gets a harness. The MDASH row is a multi-agent configuration; every other row is a bare model or a single product. Harness design alone can move the same model's score by a wide margin, which is exactly why a harness-versus-model comparison is not apples to apples.

Red, blue, and green agents in one product

Microsoft announced Project Perception the same day, a system that splits security work across three agent types.

Perception lead engineer Dave Weston said manual work that used to occupy several specialists for hours now takes minutes. Public preview opens August 3. Hayete Gallot, EVP of Microsoft Security, wrote on the company blog that the old security model of occasional scanning and later patching no longer works.

Two side announcements came with the product: Microsoft Security FORGE Labs, a research organization, and the External Red Team Alliance (EXTRA), which distributes unrestricted research funding to 18 university labs.

The price of locking the weights

The loudest thread on Hacker News after the announcement (193 points, 102 comments) was not about performance. It was about access.

Open weights? Or is Cisco's Antares model more interesting here?

MAI-Cyber-1-Flash ships without published weights, and Project Perception starts as an enterprise preview. Several comments made the same point: US vendors keep locking their "cyber" models behind specific customers. The comparison drawn repeatedly was Cisco Antares, a 1B vulnerability-localization model released under Apache 2.0 with open weights.

The two approaches solve the same problem in opposite directions. Cisco published a small model and left integration to whoever wants it. Microsoft keeps the model closed and sells the harness and routing as a finished product. A team running its own security pipeline can use the former; an organization willing to delegate the whole tool chain buys the latter.

The one transferable number here is the routing ratio. A 90/10 split producing a 50% cost cut is a public reference point for how much a purpose-built small model saves when it sits as a first-pass filter in front of a frontier model. It is also a number Microsoft measured on Microsoft's own workload.