Microsoft MDASH
Microsoft's multi-model AI agents for finding code vulnerabilities
Overview
Microsoft MDASH is a multi-model agentic code-scanning system that uses language-specialised AI agents to find, validate and deduplicate security vulnerabilities, integrated with Microsoft Defender, GitHub and Azure DevOps. In private preview for eligible organisations; models run in the customer's Azure Foundry.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 1 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
Use cases
What you can produce with Microsoft MDASH
- Multi-model agentic vulnerability scanning
- Language-specialised scanning agents
- Finding validation and deduplication
- Microsoft Defender, GitHub and Azure DevOps integration
- AI-generated fix suggestions via CLI
MDASH is a serious demonstration of AI agents finding real vulnerabilities, credited with 16 Patch Tuesday fixes and strong CyberGym results, and it fits naturally into Microsoft Defender and developer pipelines. But it is still a limited preview for eligible organisations, its benchmark scores are self-submitted, and costs depend on the Azure model usage it generates. Not yet available in Southeast Asian regions. Worth requesting access if you are a large Microsoft security customer; others should watch for general availability.
What we found
MDASH is Microsoft's multi-model agentic code-scanning system for finding security vulnerabilities, announced in May 2026; its full name is the Microsoft Security multi-model agentic scanning harness. It runs teams of AI agents built on several models — including OpenAI's GPT-5.4 and GPT-5.3-codex and Microsoft's own MAI-Cyber-1-Flash — through stages that prepare a codebase, scan it with agents specialised by language, validate and deduplicate findings and, where the type of bug allows, prove them. It has specialised agents for Java, C and C++, C#, JavaScript and TypeScript and Python, with general agents for Go, Rust, Swift and others, and it integrates with Microsoft Defender, a command-line tool, and GitHub and Azure DevOps connectors, with a command for AI-generated fixes. It was built by Microsoft's Autonomous Code Security team, which includes members of the Team Atlanta group.
Microsoft says MDASH found 16 vulnerabilities fixed in its May 2026 Patch Tuesday, four of them critical remote-code-execution flaws, and found all 21 planted bugs with no false positives in an internal test. On CyberGym, a UC Berkeley benchmark, it scored 88.45% in May, then the highest on the published leaderboard, and later 96% on a broader measure; the leaderboard now lists it among 17 leading systems above 90% and notes that teams run and submit their own results.
It is not generally available. Microsoft offers it in private, expanded preview within Microsoft Security Exposure Management for eligible organisations, through sign-up or their Microsoft account team. There is no published price for MDASH itself; the models run in the customer's own Azure Foundry resources and are billed to their Azure subscription. It is available in the US, EU, UK, Australia, India, Switzerland and the UAE, but not in Southeast Asia.
It suits large Microsoft security customers with substantial codebases; there is no independent test of it yet.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Microsoft MDASH's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Microsoft MDASH unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Microsoft MDASH directly →
Spotted something out of date? Suggest an update →
Alternatives to Microsoft MDASH
More in Security & Safety
