MAI-Cyber-1-Flash inside MDASH

Posted by migmartri 3 hours ago

Counter176Comment90OpenOriginal

Comments

Comment by gste 1 hour ago

> Data. Our deepest advantage. Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network, and an unmatched record of real exploits and remediations. No one can manufacture this history.

If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

Comment by tolugenius 1 hour ago

> does this mean Microsoft's model is best at fixing Microsoft products

"You're absolutely right, I shouldn't have delete your entire C drive. That's on me."

In serious, this would be a good advantage for Microsoft to consider, I just doubt they'd do it well.

Comment by risyachka 39 minutes ago

Considering they can't fix their login for decades, I am with you on this one

Comment by wtfHN26 59 minutes ago

> If I'm being frivolous, does this mean Microsoft's model is best at fixing Microsoft products because they have trillions of data points on problems with Microsoft products

Do they want to fix Microsoft Products ?

My laptop came with Windows 11. Windows update broke hibernate few weeks back. When laptop gets out of hibernate - Wifi works for a few minutes and then once in a while the Wifi Adapter isn't detected. I need to reboot to fix the issue, this has screwed up my workflow. Wasting a lot of time.

After troubleshooting a lot, I now only hope one day it gets fixed on it's own thanks to some new update.

If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

I wish in a few years Microsoft realize that screwing over their Desktop users to chase Cloud and AI wasn't worth it. And by that time it's too late to get back the user base.

Comment by delecti 50 minutes ago

> If Microsoft has money to invest in AI models, they could sure fix Windows 11 which I assume is one of their core products.

On the other hand, what's the return on investment for making Windows 11 better? Your laptop came with Windows 11. Most laptops that come with Windows can't not come with Windows (that is, most laptops are only available in SKUs that ship with Windows).

Comment by cyanydeez 55 minutes ago

Escaping their programming ability, Window's major issue is everything has backwards compability, so they design everything with spaghetti because they have no choice.

Comment by AnthonyMouse 6 minutes ago

Backwards compatibility was the one thing Windows got right. It was the only real reason to use it.

But backwards compatibility isn't actually that hard if you're not horrendously mismanaged to begin with. You have some ancient miserable APIs from the 1990s that you still have to support, fine, but that's not actually that bad. Old APIs tend to be small because computers were small that far back, you write a compatibility layer and can keep using it. By definition the old stuff never changes so you only have to do it once.

The actual problem is that Microsoft is full of little fiefdoms. Because what they should do, after becoming a huge behemoth with the resources to do it (which has been the case for more than two decades), is to design a set of good, modern APIs, also only once. Something that you're happy to support forever because you took the time to get it right. Then you only have to support that and the little compatibility layer for truly ancient software.

Instead, they have an army of middle managers who are practically at war with each other to show that they can introduce some kind of novel "improvement", the vast majority of which quickly fall out of favor but then have to be supported indefinitely if you don't want to break backwards compatibility. And that makes backwards compatibility a huge ordeal because every year there is more poorly-engineered rubbish you have to support forever.

Comment by gkbrk 53 minutes ago

Wine has better backwards-compatibility than Windows these days.

Comment by omosubi 50 minutes ago

what company would be better positioned for this than MS? almost every company out there runs their most important workflows on MS software

Comment by theDoug 1 hour ago

I do hope they also use it to that effect.

Comment by bonoboTP 22 minutes ago

Poking one hole in the walls will always be easier than guarding the entire frontier.

To defend properly, you need either either much more formally mathematically verified layers, or always-on online monitoring and intrusion detection running alongside the service. Like the immune system, or like guarding an empire's borders, since you can't put a guard on every meter of border. But you can detect when someone broke in and deploy your soldiers to respond. Currently we are trying to defend by building really hard walls that we hope cannot be pierced anywhere, which isn't realistic.

Comment by zurfer 2 hours ago

It looks cool but how can I use it? Somehow i don't want to go hunting for access through the rabbit hole that is Microsofts Corporate blog.

Comment by SwellJoe 1 hour ago

All the US companies are keeping their "cyber" models locked down for special customers. So, it seems like anyone who isn't at a Fortune 500 or whatever qualifies for access, will be using Chinese models for vulnerability research.

Comment by ronsor 1 hour ago

And the Chinese models are great because they don't nag you

Comment by bvttf 1 hour ago

You probably can't, they say they're adding it to MDASH, which is (I think) still in a limited preview: https://www.microsoft.com/en-us/security/blog/2026/05/12/def...

Comment by adrian_b 1 hour ago

Yes, it says:

"Sign up to join the private preview"

Comment by superloika 1 hour ago

It's a big club, and you ain't in it!

Comment by fallingbananna 1 hour ago

MAI-Code-1-Flash is available via GitHub Copilot.

I wouldn't be surprised if they added MAI-Cyber 1 there too.

Comment by cbg0 1 hour ago

I would, most of these cybersecurity models have not been made available to the public and the larger models have guardrails in place for certain cybersecurity tasks unless you've been specifically approved.

Comment by mawadev 1 hour ago

I love this pretentious design the Ai people use on their websites, its pleasing to the eye

Comment by arjie 28 minutes ago

I think it's interesting how the superstars of a space dominate the design signal in it. Other parties trying to associate with the space are then forced to participate. The AI lab being a beige background with serif fonts and an abstract image collage with illustrations being a grungy version of Corporate Memphis is 100% downstream of Anthropic dominating the current conversation in the space and therefore Geist design being the dominant design language https://geist.co/work/anthropic

Compare the Open AI and Deepmind pages:

* https://openai.com/index/gpt-5-system-card/

* https://deepmind.google/blog/announcing-google-deepmind/

This is a topic I really enjoy thinking about and I wonder if someone has explored it. It was just before the pandemic when Balenciaga rebranded where it struck me that something crazy had happened. The top fashion houses were taking their brand inspiration from Apple! I was looking at a Rimowa and it looks like an Apple mark. And Balenciaga, and Burberry (before their most recent rebrand)

The flat geometric sans wordmark and product marks wasn't an Apple original but it is definitely given full high-quality luxury status through Apple's adoption. It could just have been an idea whose time had come (Microsoft's Metro etc. existed) but if you look at the iPhone, they were already using the flat sans Myriad font at the time.

Someone more acquainted with design and art will have to tell me if this is real because when I saw it I swear it was like everyone was trying to associate with this language that was popularized by Apple. But maybe they were just copying tech because tech were the top dogs of the age. And now perhaps everyone will copy AI labs which will all copy Anthropic because Anthropic are the big dogs of this age.

Look at it, though! It's striking how much everything looks like it descended from iPhone. People were saying the Balenciaga logo looks like a phone contact!

Comment by twalla 1 minute ago

There a graphic illustrating the homogenization of a bunch of fashion houses in the late 2010s early 20s, it's come full circle and there's been a return to maximalism andheritage/legacy. Largely, I think, as a reaction to ever-accelerating trend cycles, planned obsolescence, the cursed nature of millenial targeted d2c brands and especially the looming specter of big tech - all of which have some sort of association with the clean, cool/pastel, sans-serif, minimalist kind of vibe.

https://www.designandpaper.com/they-are-calling-it-a-sans-se...

Comment by ecshafer 14 minutes ago

At least Geist looks nice. Corporate Memphis has always been ugly, beyond ugly even, its an insult to aesthetics itself, an insult to all of life.

Comment by arjie 2 minutes ago

Haha, I agree. I always thought Corporate Memphis people looked extraordinarily fat. The colours chosen to accompany were always rather jarring too. But then again, I won't claim to be much of an artist. My wife was at Figma's conference "Config" and their visual design also looks awfully jarring to me. Scroll to the bottom here: https://config.figma.com/

It seems that others like that though.

Comment by udbhavs 1 hour ago

I've been noticing the uptick of beige + serif fonts + art with rough textures in this space. It feels like an attempt to humanize the technology and make it more palatable to people. Anthropic is the biggest example of this language with its ads and promotions.

Comment by NicuCalcea 36 minutes ago

The Microsoft AI homepage mentions "human" or a variation of it 15 times, including in the tagline.

Comment by threetonesun 1 hour ago

It's very corporate hotel chain lobby restaurant inspired, which probably resonates with the C-suite people signing the checks on this stuff.

Comment by bonoboTP 12 minutes ago

It's also artisanal coffee, craft beer pub and other hip things.

Comment by omosubi 53 minutes ago

it will probably be overdone very soon, but it's way better design than most of what's out there.

Comment by trollbridge 35 minutes ago

It's also the same aesthetic as the Trump Accounts website ( https://trumpaccounts.gov/ ) - the same website where I followed all the signup flows properly but I still can't get it to create accounts for my kids who are otherwise eligible because it has a system error when I sign in, and customer service seems unable to fix it.

Comment by rustystump 24 minutes ago

Ever seen posthogs website? It is a choice for sure but i swear to god it must have been somehow polluted ai training data because their ux is now getting pooped out more than the purple tailwind of last year.

Comment by rustystump 22 minutes ago

Right as i say this they have dropped the bage for a more forestry motif

Comment by bonoboTP 10 minutes ago

Copycats copy it, then it gets associated with subpar quality then the frontier guys adopt something fresh (or something deliberately currently-very-janky or retro/outdated associated) and the barber's pole of fashion rotates once more.

Comment by stronglikedan 1 hour ago

> its pleasing to the eye

Which is precisely why I've preferred the Solarized Light Theme for years now.

Comment by twalla 12 minutes ago

The whole cycle of aesthetics is about signaling and countersignaling. This whole "look" is also about what it _isn't_ (bright, sterile, sans-serifs, weird corporate memphis purple squiggly people). It's part of the reason all the tech bros won't shut up about "taste" now and why Palantir has a cursed chore coat for some reason. I don't know how you'd even begin to turn the understanding around contextualizing why something that used to be "in" is "out" or why things like tension/juxtaposition/irony/nostalgia work into something an LLM can grasp. The irony here is that by pushing LLMs in this direction they're just more rigidily codifying the whole aesthetic and giving it a stronger, rancid AI stink which will only bring about the new thing sooner once people see this whole look as the visual equivalent of the em-dash.

Comment by FergusArgyll 47 minutes ago

It looks to me very similar to pi - Suleyman's last venture

Comment by drakythe 39 minutes ago

I really hate the constant use of bold+underlined text in places that are not links. Other underlined text are links, but bold+underlined is just emphasis. Feels like terrible UX, especially since they use it on claims that I would love to see the source of.

Comment by sixothree 54 minutes ago

Not sure if you're being serious, but it's high time we stop using black text on white backgrounds. Dark mode seems to be solved with charcoal backgrounds instead of flat black. But I'm tired of light mode being black on white. This has got to end and if AI ends it, fine by me.

Comment by tesdinger 48 minutes ago

> Decades of building world-class security systems now give us trillions of daily signals across identity, endpoint, cloud, and network

Let's say i use a linux endpoint and some hardware vendor starting with Cisc on the network. Can your product help me or not? I'm pretty sure none of these have been meant by Microsoft..but they fall into this category

Comment by ecshafer 13 minutes ago

Azure is the second largest cloud, and run majority linux. So probably.

Comment by eat 2 hours ago

[flagged]

Comment by low_tech_punk 2 hours ago

> Three things matter today: Model. Data. Harness.

*knee jerk*

Comment by smallmancontrov 1 hour ago

To whoever got rid of the emoji bullet points: if we ever meet, I owe you a beer. Keep up the good work.

Comment by testdelacc1 1 hour ago

Guys, I just had a brilliant idea. Hear me out. What if … I wrote the release post of the model with the model itself???

Comment by binsquare 1 hour ago

And we can have the model read and train on it too, completing the loop!

Comment by cwillu 26 minutes ago

It's not just a loop; it's a knot!

Comment by phoghed 33 minutes ago

Author dismayed to find the semicolon find and replace in fact did not trick anyone

Comment by walrus01 55 minutes ago

Cue the Steve Ballmer "developers developers developers developers" video. Bonus points if extra sweaty.

Comment by drakythe 44 minutes ago

I want to sit down with a sales person who doesn't work in tech day to day and see if they can recognize this kinda thing or if its only people looking for it and who have experience in the domain.

Comment by cmrdporcupine 1 hour ago

It's bad enough the cringe-word "cyber" being tossed around willy nilly. Now it's robots doing the tossing, in Claude-slop sentences.

(Having lived through the late 90s .com stuff, I can't see the word "cyber" without immediately assuming the person who wrote it is a clueless baby boomer. Unfortunately it seems to have become accepted into the lexicon. I guess by us now-clueless GenXers?)

Comment by bigfishrunning 1 hour ago

The government uses the word 'cyber' all over their security documents, and have since the mid-90s. It is indeed very cringe.

Comment by eterm 22 minutes ago

I think it's kinda cool, it's Gibsonesque, and that usage is old enough now it's rolled from awkwardly dated back to cool, especially now that people no longer tend to talk about "cybersex" and many of the other uses of "cyber".

You've got to call it something, and calling it "cyber" differentiates it from all the other kinds of security. I doubt it means much to talk about "security" to the government, that could as much mean a missile system, but I don't know, that's not my area of work.

To us developers who work with computing all day it feels cringe because the cyber part is implied, and "security" is the differentiator., so you can just talk about working in "security" or "infosec".

Is "cyber" a bit of a relic that dates when the government started taking it seriously? Of course, but I don't know if there is a good alternative that doesn't have other connotations. It probably also acts as a bit of a shibboleth in both directions, "cyber" for those in the government sphere, "infosec" in the commercial.

Comment by tigerlily 1 hour ago

I expect the gen xers are using the word in a cynical sense.

Comment by 59 minutes ago

Comment by Oras 1 hour ago

Take anything from Microsoft with grain of salt. Remember Phi?

They can’t decide on naming their product in Azure, let alone creating something useful or usable

Comment by weberer 1 hour ago

Remember Tay AI?

https://knowyourmeme.com/sensitive/memes/sites/tay-ai

Comment by paulmist 49 minutes ago

I love this video on Tay

https://www.youtube.com/watch?v=HsLup7yy-6I

Comment by samuelknight 1 hour ago

Phi was cool for what it was. But it's not 2024 anymore.

Comment by beyonddream 33 minutes ago

I wish they took some time to reflect on how best to name a model. Like, would it make sense to add the model version at the end like every other artifacts labelled in software engineering!

Comment by LorenDB 2 hours ago

Open weights, please? Otherwise Cisco's Antares models are more interesting to me.

Comment by lucrbvi 2 hours ago

Seems like MAI models from Microsoft are not going to be open-weight soon, but they are sharing a lot of details in the making of these models, which is a weird position.

Comment by tolugenius 1 hour ago

I think the idea is show in-house progress and perhaps position MAI models as the "microsoft office of AI." My take is they might open source models 2-3 release cycles later, given this is supposed to be some new product line.

Comment by SwellJoe 1 hour ago

They haven't even released the "big" version of Anteres, yet (and the "big" version is only 3B, so there's no way it's competitive with general purpose frontiers for vulnerability research). It seems like a research project. Maybe it's good for rapid triage and CI usage, but almost certainly not at all useful for general "find bugs" usage.

Comment by lanyard-textile 33 minutes ago

The year is 2026.

We invented AGI.

There is a transparent 20px gap above the opaque screen-fixed header.

Comment by drevil-v2 1 hour ago

This feels like it was written by Claude. I noticed several "it's not x, not y, it's z" claude-isms in the blog post.

And I am 90% sure that Claude design was used to build the website.

Comment by debesyla 1 hour ago

It also can be human author, influenced by LLM writing. Though I'm not sure which is worse.

Comment by saadn92 1 hour ago

we have a lot of upper management using AI to write their messages now and it's pretty obvious. not sure how I feel about it.

Comment by drevil-v2 1 hour ago

> not sure how I feel about it

Same. I feel amused, disgusted and disdain at the same time.

Sprinkle in some irritation that even for a big product launch not a single human in the chain could be bothered to sit down and devote their attention to writing a page on why this product matters and why we should care..

Comment by pranshuchittora 1 hour ago

WTH is this sloppy UI design

Comment by dkeners 1 hour ago

I know... Hovering over Accessibility Mode in the bottom left displays like it is clickable, but alas, only the tiny off button inside the pill is really clickable. I clicked on the text one too many times before realizing it wasn't actually selectable...

Comment by chvid 1 hour ago

How much of this security related stuff is open source? Models, training data, evaluation benchmarks?

Comment by tty46 1 hour ago

curious-- does anyone have experience with the remediation capabilities of MDASH? they mention it a few times, but the test on CyberGym only gives me pause-- that is only for creating POCs, nothing to do with creating patches.

Comment by danieltk76 42 minutes ago

the problem is they are using cybergym, which has been saturated for a few months now.

Comment by TheOtherHobbes 36 minutes ago

"...talent-dense..."

[wince]

Comment by thallavajhula 1 hour ago

Is it just me or do all the proprietary AI model companies have their blogs styled to have earthy calming tones? This seems like a strategy.

Exhibit A-C

A. https://claude.com/blog B. https://microsoft.ai/news/introducing-mai-cyber-1-flash-insi... C. https://cursor.com/grok

Only OpenAI's blog looks like the WordPress _Twenty Twenty Five_ theme.

Comment by caminanteblanco 1 hour ago

The Gemini team uses the standard Google blue and white, which I would have thought Microsoft would be inclined to do as well

Comment by udbhavs 1 hour ago

Not surprising considering out of all the things MS is known for, UX consistency is certainly not one of them. They have probably the weakest commitment to a design language across all the big tech cos.

Comment by bztzt 1 hour ago

MAI is supposed to have its own design language/brand identity that is unrelated to the overall Microsoft brand. It has its own fonts, logo, colors, etc. The weird thing is that consumer Copilot, which is (or was) developed at MAI (as opposed to business/M365 Copilot which is developed in Redmond and designed based on the regular Microsoft stuff) also has its own design language which is different from the regular Microsoft stuff and different from the MAI stuff.

tbh all of this has always struck me as an ego thing from the MAI team, who are mostly based in Silicon Valley, not Redmond, and think of themselves as too cool for Microsoft

Comment by 1 hour ago

Comment by andhug 1 hour ago

and it seems this site was generated with ai and then not reviewed before publishing. the layout of the content below the header doesn't really make sense and the "LI X FB" for LinkedIn, X, and Facebook is super unintuitive until you click one - and even after clicking one, i thought it was a collaboration between LinkedIn and Facebook tbh. then the animations are jarring and don't obey my reduced motion system settings, which isnt uncommon but i would expect it from Microsoft. finally, the "Explore all jobs" button at the bottom is just bizarrely designed and animated.

Comment by smallmancontrov 1 hour ago

It's better than Corporate Memphis, at least.

Comment by eclipticplane 16 minutes ago

That's my biggest fear after LLMs can pass the pelican-riding-a-bicycle test... Corporate Memphis art is a half step beyond and there's bound to be a _lot_ of it in their upstream data.

Comment by udbhavs 1 hour ago

It's a trend that signals a form of non-chronically-online intellectualism. Feels reminiscent of intellectual slop [1] content on the web that is in vogue

https://www.youtube.com/shorts/dEYvdnwB4MM

Comment by sajithdilshan 1 hour ago

I despise that kind of shorts/reels/videos. Like who talks that fast and my brain immediately lose interest and it's obnoxious and unnatural.

Comment by tesdinger 47 minutes ago

Does it work on Linux

Comment by Fitzee_web 24 minutes ago

wow rlly nice topic

Comment by antondd 1 hour ago

Ignoring my first immediate knee-jerk reaction to the blog and taking it at face value - I do tend to agree with Alex Karp on data becoming the moat for enterprises. Hyperscalers and the like are not different - it makes 0 sense to make swaths of business’s alpha available to potential future competitors. Even if MS and OAI are “friends”. Balkanization of cyber seems inevitable.

Comment by sudo_cowsay 1 hour ago

I love how the discussion here isn't taking ms seriously lol

Comment by drakythe 36 minutes ago

It is interesting, even the most random LLM model announcement gets plenty of discussion about the merits of the model or others, or the harness, or something. This one has like... 2 comments about the announcement itself and the rest of meta commentary on the announcement being clearly LLM written and availability.

Comment by bflesch 1 hour ago

I can't even joke about Microsoft, I just feel pity for them. So long at the game and reduced from a dominating software house to slop fabric with no professional honor to deliver a product with certain quality level.

Their cash cow customers are doofuses that decide over government contracts to be wined & dined, their best employees use macbooks, it's a sad shell of what has been.

Comment by mherkender 31 minutes ago

I think Microsoft is the terminal state of a big tech company. Big tech companies will all eventually carcinize into Microsoft given enough time.

Comment by rebirth01 10 minutes ago

[flagged]

Comment by nttylock 1 hour ago

[flagged]

Comment by solenoid0937 2 hours ago

[flagged]

Comment by behole 1 hour ago

Exactly correct! I can see you have already been down-voted by the HN Elite. Bound to happen.