MAI-Cyber-1-Flash inside MDASH

(microsoft.ai)

179 points | by migmartri 3 hours ago

25 comments

  • gste 1 hour ago
    > Data. Our deepest advantage. Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network, and an unmatched record of real exploits and remediations. No one can manufacture this history.

    If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

    • tolugenius 1 hour ago
      > does this mean Microsoft's model is best at fixing Microsoft products

      "You're absolutely right, I shouldn't have delete your entire C drive. That's on me."

      In serious, this would be a good advantage for Microsoft to consider, I just doubt they'd do it well.

      • risyachka 47 minutes ago
        Considering they can't fix their login for decades, I am with you on this one
    • wtfHN26 1 hour ago
      > If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

      Do they want to fix Microsoft Products ?

      My laptop came with Windows 11. Windows update broke hibernate few weeks back. When laptop gets out of hibernate - Wifi works for a few minutes and then once in a while the Wifi Adapter isn't detected. I need to reboot to fix the issue, this has screwed up my workflow. Wasting a lot of time.

      After troubleshooting a lot, I now only hope one day it gets fixed on it's own thanks to some new update.

      If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

      I wish in a few years Microsoft realize that screwing over their Desktop users to chase Cloud and AI wasn't worth it. And by that time it's too late to get back the user base.

      • delecti 58 minutes ago
        > If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

        On the other hand, what's the return on investment for making Windows 11 better? Your laptop came with Windows 11. Most laptops that come with Windows can't not come with Windows (that is, most laptops are only available in SKUs that ship with Windows).

      • cyanydeez 1 hour ago
        Escaping their programming ability, Window's major issue is everything has backwards compability, so they design everything with spaghetti because they have no choice.
        • AnthonyMouse 14 minutes ago
          Backwards compatibility was the one thing Windows got right. It was the only real reason to use it.

          But backwards compatibility isn't actually that hard if you're not horrendously mismanaged to begin with. You have some ancient miserable APIs from the 1990s that you still have to support, fine, but that's not actually that bad. Old APIs tend to be small because computers were small that far back, you write a compatibility layer and can keep using it. By definition the old stuff never changes so you only have to do it once.

          The actual problem is that Microsoft is full of little fiefdoms. Because what they should do, after becoming a huge behemoth with the resources to do it (which has been the case for more than two decades), is to design a set of good, modern APIs, also only once. Something that you're happy to support forever because you took the time to get it right. Then you only have to support that and the little compatibility layer for truly ancient software.

          Instead, they have an army of middle managers who are practically at war with each other to show that they can introduce some kind of novel "improvement", the vast majority of which quickly fall out of favor but then have to be supported indefinitely if you don't want to break backwards compatibility. And that makes backwards compatibility a huge ordeal because every year there is more poorly-engineered rubbish you have to support forever.

        • gkbrk 1 hour ago
          Wine has better backwards-compatibility than Windows these days.
    • omosubi 59 minutes ago
      what company would be better positioned for this than MS? almost every company out there runs their most important workflows on MS software
    • theDoug 1 hour ago
      I do hope they also use it to that effect.
  • zurfer 2 hours ago
    It looks cool but how can I use it? Somehow i don't want to go hunting for access through the rabbit hole that is Microsofts Corporate blog.
    • SwellJoe 1 hour ago
      All the US companies are keeping their "cyber" models locked down for special customers. So, it seems like anyone who isn't at a Fortune 500 or whatever qualifies for access, will be using Chinese models for vulnerability research.
      • ronsor 1 hour ago
        And the Chinese models are great because they don't nag you
    • bvttf 2 hours ago
      You probably can't, they say they're adding it to MDASH, which is (I think) still in a limited preview: https://www.microsoft.com/en-us/security/blog/2026/05/12/def...
      • adrian_b 1 hour ago
        Yes, it says:

        "Sign up to join the private preview"

    • superloika 1 hour ago
      It's a big club, and you ain't in it!
    • fallingbananna 2 hours ago
      MAI-Code-1-Flash is available via GitHub Copilot.

      I wouldn't be surprised if they added MAI-Cyber 1 there too.

      • cbg0 1 hour ago
        I would, most of these cybersecurity models have not been made available to the public and the larger models have guardrails in place for certain cybersecurity tasks unless you've been specifically approved.
  • bonoboTP 30 minutes ago
    Poking one hole in the walls will always be easier than guarding the entire frontier.

    To defend properly, you need either either much more formally mathematically verified layers, or always-on online monitoring and intrusion detection running alongside the service. Like the immune system, or like guarding an empire's borders, since you can't put a guard on every meter of border. But you can detect when someone broke in and deploy your soldiers to respond. Currently we are trying to defend by building really hard walls that we hope cannot be pierced anywhere, which isn't realistic.

  • tesdinger 56 minutes ago
    > Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network

    Let's say i use a linux endpoint and some hardware vendor starting with Cisc on the network. Can your product help me or not? I'm pretty sure none of these have been meant by Microsoft..but they fall into this category

    • ecshafer 21 minutes ago
      Azure is the second largest cloud, and run majority linux. So probably.
  • eat 2 hours ago
    [flagged]
    • low_tech_punk 2 hours ago
      > Three things matter today: Model. Data. Harness.

      *knee jerk*

      • smallmancontrov 1 hour ago
        To whoever got rid of the emoji bullet points: if we ever meet, I owe you a beer. Keep up the good work.
      • testdelacc1 2 hours ago
        Guys, I just had a brilliant idea. Hear me out. What if … I wrote the release post of the model with the model itself???
        • binsquare 1 hour ago
          And we can have the model read and train on it too, completing the loop!
          • cwillu 35 minutes ago
            It's not just a loop; it's a knot!
    • phoghed 41 minutes ago
      Author dismayed to find the semicolon find and replace in fact did not trick anyone
    • walrus01 1 hour ago
      Cue the Steve Ballmer "developers developers developers developers" video. Bonus points if extra sweaty.
    • drakythe 53 minutes ago
      I want to sit down with a sales person who doesn't work in tech day to day and see if they can recognize this kinda thing or if its only people looking for it and who have experience in the domain.
    • cmrdporcupine 1 hour ago
      It's bad enough the cringe-word "cyber" being tossed around willy nilly. Now it's robots doing the tossing, in Claude-slop sentences.

      (Having lived through the late 90s .com stuff, I can't see the word "cyber" without immediately assuming the person who wrote it is a clueless baby boomer. Unfortunately it seems to have become accepted into the lexicon. I guess by us now-clueless GenXers?)

      • bigfishrunning 1 hour ago
        The government uses the word 'cyber' all over their security documents, and have since the mid-90s. It is indeed very cringe.
        • eterm 30 minutes ago
          I think it's kinda cool, it's Gibsonesque, and that usage is old enough now it's rolled from awkwardly dated back to cool, especially now that people no longer tend to talk about "cybersex" and many of the other uses of "cyber".

          You've got to call it something, and calling it "cyber" differentiates it from all the other kinds of security. I doubt it means much to talk about "security" to the government, that could as much mean a missile system, but I don't know, that's not my area of work.

          To us developers who work with computing all day it feels cringe because the cyber part is implied, and "security" is the differentiator., so you can just talk about working in "security" or "infosec".

          Is "cyber" a bit of a relic that dates when the government started taking it seriously? Of course, but I don't know if there is a good alternative that doesn't have other connotations. It probably also acts as a bit of a shibboleth in both directions, "cyber" for those in the government sphere, "infosec" in the commercial.

      • tigerlily 1 hour ago
        I expect the gen xers are using the word in a cynical sense.
  • Oras 1 hour ago
    Take anything from Microsoft with grain of salt. Remember Phi?

    They can’t decide on naming their product in Azure, let alone creating something useful or usable

  • LorenDB 2 hours ago
    Open weights, please? Otherwise Cisco's Antares models are more interesting to me.
    • lucrbvi 2 hours ago
      Seems like MAI models from Microsoft are not going to be open-weight soon, but they are sharing a lot of details in the making of these models, which is a weird position.
      • tolugenius 1 hour ago
        I think the idea is show in-house progress and perhaps position MAI models as the "microsoft office of AI." My take is they might open source models 2-3 release cycles later, given this is supposed to be some new product line.
    • SwellJoe 1 hour ago
      They haven't even released the "big" version of Anteres, yet (and the "big" version is only 3B, so there's no way it's competitive with general purpose frontiers for vulnerability research). It seems like a research project. Maybe it's good for rapid triage and CI usage, but almost certainly not at all useful for general "find bugs" usage.
  • beyonddream 42 minutes ago
    I wish they took some time to reflect on how best to name a model. Like, would it make sense to add the model version at the end like every other artifacts labelled in software engineering!
  • drevil-v2 1 hour ago
    This feels like it was written by Claude. I noticed several "it's not x, not y, it's z" claude-isms in the blog post.

    And I am 90% sure that Claude design was used to build the website.

    • debesyla 1 hour ago
      It also can be human author, influenced by LLM writing. Though I'm not sure which is worse.
    • saadn92 1 hour ago
      we have a lot of upper management using AI to write their messages now and it's pretty obvious. not sure how I feel about it.
      • drevil-v2 1 hour ago
        > not sure how I feel about it

        Same. I feel amused, disgusted and disdain at the same time.

        Sprinkle in some irritation that even for a big product launch not a single human in the chain could be bothered to sit down and devote their attention to writing a page on why this product matters and why we should care..

  • lanyard-textile 42 minutes ago
    The year is 2026.

    We invented AGI.

    There is a transparent 20px gap above the opaque screen-fixed header.

  • chvid 1 hour ago
    How much of this security related stuff is open source? Models, training data, evaluation benchmarks?
  • tty46 1 hour ago
    curious-- does anyone have experience with the remediation capabilities of MDASH? they mention it a few times, but the test on CyberGym only gives me pause-- that is only for creating POCs, nothing to do with creating patches.
  • danieltk76 51 minutes ago
    the problem is they are using cybergym, which has been saturated for a few months now.
  • thallavajhula 2 hours ago
    Is it just me or do all the proprietary AI model companies have their blogs styled to have earthy calming tones? This seems like a strategy.

    Exhibit A-C

    A. https://claude.com/blog B. https://microsoft.ai/news/introducing-mai-cyber-1-flash-insi... C. https://cursor.com/grok

    Only OpenAI's blog looks like the WordPress _Twenty Twenty Five_ theme.

    • caminanteblanco 1 hour ago
      The Gemini team uses the standard Google blue and white, which I would have thought Microsoft would be inclined to do as well
      • udbhavs 1 hour ago
        Not surprising considering out of all the things MS is known for, UX consistency is certainly not one of them. They have probably the weakest commitment to a design language across all the big tech cos.
        • bztzt 1 hour ago
          MAI is supposed to have its own design language/brand identity that is unrelated to the overall Microsoft brand. It has its own fonts, logo, colors, etc. The weird thing is that consumer Copilot, which is (or was) developed at MAI (as opposed to business/M365 Copilot which is developed in Redmond and designed based on the regular Microsoft stuff) also has its own design language which is different from the regular Microsoft stuff and different from the MAI stuff.

          tbh all of this has always struck me as an ego thing from the MAI team, who are mostly based in Silicon Valley, not Redmond, and think of themselves as too cool for Microsoft

    • andhug 1 hour ago
      and it seems this site was generated with ai and then not reviewed before publishing. the layout of the content below the header doesn't really make sense and the "LI X FB" for LinkedIn, X, and Facebook is super unintuitive until you click one - and even after clicking one, i thought it was a collaboration between LinkedIn and Facebook tbh. then the animations are jarring and don't obey my reduced motion system settings, which isnt uncommon but i would expect it from Microsoft. finally, the "Explore all jobs" button at the bottom is just bizarrely designed and animated.
    • smallmancontrov 1 hour ago
      It's better than Corporate Memphis, at least.
      • eclipticplane 24 minutes ago
        That's my biggest fear after LLMs can pass the pelican-riding-a-bicycle test... Corporate Memphis art is a half step beyond and there's bound to be a _lot_ of it in their upstream data.
    • udbhavs 1 hour ago
      It's a trend that signals a form of non-chronically-online intellectualism. Feels reminiscent of intellectual slop [1] content on the web that is in vogue

      https://www.youtube.com/shorts/dEYvdnwB4MM

      • sajithdilshan 1 hour ago
        I despise that kind of shorts/reels/videos. Like who talks that fast and my brain immediately lose interest and it's obnoxious and unnatural.
  • TheOtherHobbes 44 minutes ago
    "...talent-dense..."

    [wince]

  • tesdinger 56 minutes ago
    Does it work on Linux
  • Fitzee_web 33 minutes ago
    wow rlly nice topic
  • antondd 1 hour ago
    Ignoring my first immediate knee-jerk reaction to the blog and taking it at face value - I do tend to agree with Alex Karp on data becoming the moat for enterprises. Hyperscalers and the like are not different - it makes 0 sense to make swaths of business’s alpha available to potential future competitors. Even if MS and OAI are “friends”. Balkanization of cyber seems inevitable.
  • bflesch 1 hour ago
    I can't even joke about Microsoft, I just feel pity for them. So long at the game and reduced from a dominating software house to slop fabric with no professional honor to deliver a product with certain quality level.

    Their cash cow customers are doofuses that decide over government contracts to be wined & dined, their best employees use macbooks, it's a sad shell of what has been.

    • mherkender 40 minutes ago
      I think Microsoft is the terminal state of a big tech company. Big tech companies will all eventually carcinize into Microsoft given enough time.
  • sudo_cowsay 1 hour ago
    I love how the discussion here isn't taking ms seriously lol
    • drakythe 44 minutes ago
      It is interesting, even the most random LLM model announcement gets plenty of discussion about the merits of the model or others, or the harness, or something. This one has like... 2 comments about the announcement itself and the rest of meta commentary on the announcement being clearly LLM written and availability.
  • mawadev 1 hour ago
    I love this pretentious design the Ai people use on their websites, its pleasing to the eye
    • arjie 37 minutes ago
      I think it's interesting how the superstars of a space dominate the design signal in it. Other parties trying to associate with the space are then forced to participate. The AI lab being a beige background with serif fonts and an abstract image collage with illustrations being a grungy version of Corporate Memphis is 100% downstream of Anthropic dominating the current conversation in the space and therefore Geist design being the dominant design language https://geist.co/work/anthropic

      Compare the Open AI and Deepmind pages:

      * https://openai.com/index/gpt-5-system-card/

      * https://deepmind.google/blog/announcing-google-deepmind/

      This is a topic I really enjoy thinking about and I wonder if someone has explored it. It was just before the pandemic when Balenciaga rebranded where it struck me that something crazy had happened. The top fashion houses were taking their brand inspiration from Apple! I was looking at a Rimowa and it looks like an Apple mark. And Balenciaga, and Burberry (before their most recent rebrand)

      The flat geometric sans wordmark and product marks wasn't an Apple original but it is definitely given full high-quality luxury status through Apple's adoption. It could just have been an idea whose time had come (Microsoft's Metro etc. existed) but if you look at the iPhone, they were already using the flat sans Myriad font at the time.

      Someone more acquainted with design and art will have to tell me if this is real because when I saw it I swear it was like everyone was trying to associate with this language that was popularized by Apple. But maybe they were just copying tech because tech were the top dogs of the age. And now perhaps everyone will copy AI labs which will all copy Anthropic because Anthropic are the big dogs of this age.

      Look at it, though! It's striking how much everything looks like it descended from iPhone. People were saying the Balenciaga logo looks like a phone contact!

      • twalla 9 minutes ago
        There's a graphic illustrating the typographic homogenization of a bunch of fashion houses in the late 2010s early 20s like you described in the article below. It's come full circle and there's been a return to maximalism and signaling heritage/legacy among some brands. Largely, I think, as a reaction to ever-accelerating trend cycles, planned obsolescence, the cursed nature of millenial targeted d2c brands and especially the looming specter of big tech - all of which have some sort of association with the clean, cool/pastel, sans-serif, minimalist kind of vibe.

        https://www.designandpaper.com/they-are-calling-it-a-sans-se...

      • ecshafer 22 minutes ago
        At least Geist looks nice. Corporate Memphis has always been ugly, beyond ugly even, its an insult to aesthetics itself, an insult to all of life.
        • arjie 10 minutes ago
          Haha, I agree. I always thought Corporate Memphis people looked extraordinarily fat. The colours chosen to accompany were always rather jarring too. But then again, I won't claim to be much of an artist. My wife was at Figma's conference "Config" and their visual design also looks awfully jarring to me. Scroll to the bottom here: https://config.figma.com/

          It seems that others like that though.

    • udbhavs 1 hour ago
      I've been noticing the uptick of beige + serif fonts + art with rough textures in this space. It feels like an attempt to humanize the technology and make it more palatable to people. Anthropic is the biggest example of this language with its ads and promotions.
      • threetonesun 1 hour ago
        It's very corporate hotel chain lobby restaurant inspired, which probably resonates with the C-suite people signing the checks on this stuff.
        • bonoboTP 21 minutes ago
          It's also artisanal coffee, craft beer pub and other hip things.
        • omosubi 1 hour ago
          it will probably be overdone very soon, but it's way better design than most of what's out there.
      • NicuCalcea 44 minutes ago
        The Microsoft AI homepage mentions "human" or a variation of it 15 times, including in the tagline.
      • trollbridge 44 minutes ago
        It's also the same aesthetic as the Trump Accounts website ( https://trumpaccounts.gov/ ) - the same website where I followed all the signup flows properly but I still can't get it to create accounts for my kids who are otherwise eligible because it has a system error when I sign in, and customer service seems unable to fix it.
      • rustystump 32 minutes ago
        Ever seen posthogs website? It is a choice for sure but i swear to god it must have been somehow polluted ai training data because their ux is now getting pooped out more than the purple tailwind of last year.
        • udbhavs 5 minutes ago
          Honestly, I'd take this over purple tailwind any day. That style has given me an ick for the color scheme I don't know if I'll ever shake off
        • rustystump 30 minutes ago
          Right as i say this they have dropped the bage for a more forestry motif
    • stronglikedan 1 hour ago
      > its pleasing to the eye

      Which is precisely why I've preferred the Solarized Light Theme for years now.

    • bonoboTP 18 minutes ago
      Copycats copy it, then it gets associated with subpar quality then the frontier guys adopt something fresh (or something deliberately currently-very-janky or retro/outdated associated) and the barber's pole of fashion rotates once more.
    • twalla 20 minutes ago
      The whole cycle of aesthetics is about signaling and countersignaling. This whole "look" is also about what it _isn't_ (bright, sterile, sans-serifs, weird corporate memphis purple squiggly people). It's part of the reason all the tech bros won't shut up about "taste" now and Palantir has a storefront with a chore coat drop (someone thought they cooked lol). I don't know how you'd even begin to turn the understanding around contextualizing why something that used to be "in" is "out" or why things like tension/juxtaposition/irony/nostalgia work into something an LLM can grasp. The irony here is that by pushing LLMs in this direction they're just more rigidily codifying the whole aesthetic and giving it a stronger, rancid AI stink which will only bring about the new thing sooner once people see this whole look as the visual equivalent of the em-dash.
    • FergusArgyll 56 minutes ago
      It looks to me very similar to pi - Suleyman's last venture
    • drakythe 48 minutes ago
      I really hate the constant use of bold+underlined text in places that are not links. Other underlined text are links, but bold+underlined is just emphasis. Feels like terrible UX, especially since they use it on claims that I would love to see the source of.
    • sixothree 1 hour ago
      Not sure if you're being serious, but it's high time we stop using black text on white backgrounds. Dark mode seems to be solved with charcoal backgrounds instead of flat black. But I'm tired of light mode being black on white. This has got to end and if AI ends it, fine by me.
  • rebirth01 19 minutes ago
    [flagged]
  • nttylock 2 hours ago
    [flagged]
  • pranshuchittora 1 hour ago
    WTH is this sloppy UI design
    • dkeners 1 hour ago
      I know... Hovering over Accessibility Mode in the bottom left displays like it is clickable, but alas, only the tiny off button inside the pill is really clickable. I clicked on the text one too many times before realizing it wasn't actually selectable...
  • solenoid0937 2 hours ago
    [flagged]