MAI Cyber

Private preview

Explore the documented capabilities of MAI-Cyber-1-Flash and prepare a synthetic security review.

Input preparation only. These examples are not model-generated findings, and no inference request is made.

Approved private API contract required

The published model card limits this model to approved defensive operations within Microsoft Defender's Project MDASH. It does not document a standalone inference API. This standalone integration remains unavailable until an approved private contract is supplied.

No endpoint, authentication scheme, streaming support, or output-token limit is assumed. This page never calls MAI-Thinking as a substitute for MAI Cyber.

Prepare a synthetic scenario

Security scenario

Prioritize a synthetic application's exposure using evidence, impact, and confidence.

Loading replaces the prompt below. Draft edits stay in memory. Use the storage menu to save or import a draft session.

What the model card establishes

Model: MAI-Cyber-1-Flash
Specialization: Vulnerability discovery, validation, prioritization, and remediation assistance inside MDASH.
Immediate parent: A fine-tune of MAI-Code-1-Flash, within the broader MAI-Thinking-1 lineage.
Architecture: Sparse mixture of experts: 137 billion total parameters, 5 billion active.
Input and output: Text, with a published 256k-token context window.
Access: Approved customers through Foundry Private Preview, solely for MDASH under the published terms.

The MAI-Thinking-1 technical report describes a different model. Its parameter counts, inference controls, and output limits must not be treated as Cyber specifications.

How MAI Cyber fits into MDASH

MDASH combines multiple models with a Prepare, Scan, Validate, Dedupe, and Prove pipeline. Its independent validation, controlled execution, and SARIF and HTML findings are not reproduced by this page. Published MDASH benchmark and cost results describe that system, not standalone MAI Cyber accuracy or pricing.

The current MAI Cyber scan configuration adds MAI-Cyber-1-Flash to MDASH's gpt-5.4, gpt-5.3-codex, and gpt-5.4-mini deployments. These are MDASH setup requirements, not a documented direct-model calling contract. Exposure Management updates identify Standard as the default scan configuration.

MDASH onboarding supports keyless managed-identity authentication, as well as API keys. Its scanning-specific filtering guidance requires a dedicated MDASH-only endpoint. Do not reuse that endpoint or relax general-purpose application filters for this playground.

Standalone integration prerequisites and responsible use

To enable live inference, supply an approved standalone-use contract specifying the endpoint, authentication, deployment routing, request and response schemas, supported controls, and error and streaming behavior. Public MDASH deployment instructions alone do not supply that contract.

Only use synthetic or authorized evidence. Remove credentials, personal data, and unnecessary customer information. Treat findings as unverified recommendations, cite supplied evidence, and have a qualified person validate conclusions. This page does not access hosts, execute code, apply fixes, or request secrets.

General reasoning is available separately in the MAI-Thinking playground. That is a different model, not a fallback implementation of MAI Cyber.

Documentation behind this playground

Live inference unavailable. No endpoint or credentials are collected.