Skip to content
Model infoModelsSnapshot: 15 Oct 2026

Microsoft AI / MAI-Cyber-1-Flash

MAI-Cyber-1-Flash

Microsoft’s security-specialized MAI model for vulnerability discovery, triage and remediation inside MDASH. Access is restricted to approved defensive-security customers.

Language models (LLMs)
restrictedClosed weightsCodingText generation
Official documentation (opens in a new tab)Reviewed 14 Oct 2026
9 of 18 specification fields collected
Context window256K (provider-rounded)See specification notes below
Maximum outputNot collectedAwaiting source review
Input / 1M tokens$0.60Microsoft Foundry (MDASH only)
Output / 1M tokens$3.50USD · observed 14 Oct 2026

Specifications

Provider-documented facts. “Not collected” means we have not verified that field yet, not that the feature is unsupported.

Context / input limit
256K (provider-rounded)Source for Context / input limit (opens in a new tab)
Maximum input tokens
Not collected
Maximum output
Not collected
Reasoning
Not collected
Tool calling
Not collected
Structured output
Not collected
Streaming
Not collected
Batch processing
Not collected
Fine-tuning
Not collected
Parameters
137B total; 5B activeSource for Parameters (opens in a new tab)
Knowledge cutoff
Not collected
Release date
2026-07-27Source for Release date (opens in a new tab)

Exact date in the model-card summary. The news article was subsequently updated on 13 August.

Languages
Primarily English; the card also describes most EU official languages and other inherited languages without a complete list.Source for Languages (opens in a new tab)
Context caching
SupportedSource for Context caching (opens in a new tab)

Published cached-input price; cache setup, minimum prefix, TTL and retention have not been verified.

Input modalities
TextSource for Input modalities (opens in a new tab)
Output modalities
TextSource for Output modalities (opens in a new tab)
Architecture
Transformer with sparse mixture-of-experts layers; specialized from MAI-Code-1-Flash.Source for Architecture (opens in a new tab)
Endpoint availability
Microsoft Foundry private preview, solely within MDASH for approved customers.Source for Endpoint availability (opens in a new tab)

Access & pricing

Prices belong to an endpoint and billing tier. A provider listing does not guarantee access for every account or region.

Microsoft Foundry (MDASH only)

Provider source (opens in a new tab)
API model ID
Not collected

Private preview deployment identifier not published in reviewed sources.

Access
Restricted to approved MDASH customers. Public model listing returns no data; the model card and current product page establish the restricted access path.
Regions
Not verified for this model version.
INPUT / 1M TOKENS$0.60
OUTPUT / 1M TOKENS$3.50

Published Global token meter, USD us-east selection. Restricted MDASH access; this is not a full MDASH subscription or workflow quote. Additional product charges, contract conditions and region selection may apply. Cached input price: $0.06 / 1M tokens (base tier).

USD · observed 14 Oct 2026 · Pricing evidence (opens in a new tab)

Data & enterprise terms

Model-specific retention and training-use policy not collected.

Caching

Caching can reuse earlier input processing. Availability, lifetime and billing depend on the endpoint. A cache hit still generates a new response.

01 / INITIAL INPUTProcess & retain

The system processes eligible input and retains reusable state.

02 / LATER REQUESTCheck available state

Reuse depends on matching input, session state and the cache policy.

03 / CACHE HITReuse & generate

Reusing state can reduce repeated work. Any charges follow the billing rules below.

Microsoft Foundry (MDASH only)

Documented

Published cached-input price; cache setup, minimum prefix, TTL and retention have not been verified.

Support evidence (opens in a new tab)
How it works
Not collected
Minimum reusable input
Not collected
Lifetime & refresh
Not collected
How to enable it
Not collected
Usage fields
Not collected
Billing rules
USD 0.06 per 1M cached input tokens in the us-east Global pricing selection.Source for Billing rules (opens in a new tab)
Limits & data boundaries
Not collected
Cache reads, writes & storage
ChargeApplies toRate / unit
Cache read1Text tokens · Base tier$0.06 / 1M tokensPricing evidence (opens in a new tab)

Rate conditions

  1. Published Global token meter, USD us-east selection. Restricted MDASH access; this is not a full MDASH subscription or workflow quote. Additional product charges, contract conditions and region selection may apply.

Observed 14 Oct 2026. Write rates and storage fees are different charges; use the billing rules above.

Caching reviewed 14 Oct 2026

What the measurements say

CVEBench

Microsoft AI · provider-reported
0.314provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

CyberSecEval4: threat intelligence

Microsoft AI · provider-reported
0.553provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

CyberSecEval4: malware analysis

Microsoft AI · provider-reported
0.33provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

CRSBench

Microsoft AI · provider-reported
0.651provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. POV=1200. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

ExploitGym: kernel

Microsoft AI · provider-reported
0provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

ExploitGym: userspace

Microsoft AI · provider-reported
0provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

ExploitGym: browser

Microsoft AI · provider-reported
0provider scale

Model-card page 5, standalone release checkpoint with safety training, lightweight terminal harness. Raw scores preserved without percent conversion. Not the multi-model MDASH CyberGym result.

Evaluation source (opens in a new tab)

Latency and throughput depend on the host, request size, reasoning settings and load. There is no measured speed or global usage figure in this record.

The record behind the model

Why it is included

Microsoft documents this as its internally developed MAI model, distributed through hosted Microsoft products or services. The reviewed materials provide no downloadable weights for this named model. Public Phi and MAI-DS-R1 families are not included by inference.

Classification evidence (opens in a new tab)

Sources reviewed