The same loop that attacked servers in May now works for the defense

Rewind to May 7, 2026. Somebody in Zhuhai, China typed one instruction into Telegram and walked away. What answered wasn't a person — it was an AI agent running on their own server. It queried an internet asset search engine, harvested exposed instances of an open-source tool, pulled proof-of-concept exploit code off GitHub, ran parallel scanning threads, decided on its own that the first target class wasn't worth the trouble, and pivoted to a completely different product without being told to. Unit 42 published the full reconstruction on July 31. The autonomous attacks scored zero successful compromises, but the line that stuck was not the scoreboard: "the technical barrier to entry for AI-augmented offensive operations is low and continues to decrease."

Three days later, Microsoft opened the door on the mirror image of that loop. On August 3, 2026, Project Perception entered public preview inside the Microsoft Defender portal. Inside it lives something called a red team agent. What it does is, conceptually, close to what that DeepSeek-driven agent was doing in May: scout the environment, map paths to compromise, surface choke points, valuable assets, misconfigurations, excess permissions. The difference is where the output goes. One feeds an exploit. The other feeds a ticket.

The announcement itself landed July 27. Hayete Gallot, Executive Vice President of Microsoft Security, posted "Rethinking security for the age of AI" on the official Microsoft blog, and she opened with a hell of a line: "The physics of cybersecurity are changing." The cost of offense is falling while the volume, velocity and complexity of what has to be defended keeps growing. Her conclusion: "Security needs a new cyber stack." Project Perception is that stack.

Here's what's worth actually digging into. What red, blue and green really mean in practice. What that headline 96% score is a score of — because it isn't what most coverage implies. And the most revealing detail of all: why a launch this loud shipped without the one capability the whole architecture was built around. That last answer is the most honest part of this story.

Who's actually in this fight

Start with Microsoft Security itself. Gallot's org spans identity (Entra), threat protection (Defender), compliance, and data security. Its real weapon isn't a model — it's position. The Perception announcement leans hard on exactly that: visibility across identities, endpoints, applications, data, clouds, and AI systems, plus the ability to take action across all of them. Futurum analyst Fernando Montenegro made the same call in his read of the launch. Microsoft's advantage, he argued, isn't the agents but "entrenchment in the enterprise itself, Active Directory and Entra identity, Windows endpoints" — with roughly 77% pervasion in information security among the respondents Futurum surveyed.

Second player: MDASH, the quiet protagonist here. Microsoft introduced it in a May 12, 2026 Security Blog post. It's an agentic vulnerability discovery and remediation system that orchestrates more than 100 specialized agents through a Prepare → Scan → Validate → Dedupe → Prove pipeline, using an ensemble of frontier and distilled models rather than one big brain. Microsoft's framing then was pointed: "the harness does the work, and the model is one input." Single-model code review, the argument goes, misses cross-file patterns and multi-step vulnerability chains. The receipts were real — MDASH found 16 vulnerabilities in the Windows networking stack, four of them Critical remote code execution bugs across tcpip.sys and ikeext.dll, shipped in the May 12 Patch Tuesday.

Third: MAI-Cyber-1-Flash, announced July 27 under the joint bylines of Microsoft AI chief Mustafa Suleyman and Gallot. It's Microsoft's first model built in-house specifically for cyber defense. Microsoft AI describes it as "a compact, code-heavy security model derived from the MAI-Thinking-1 lineage, which was built from scratch, in-house, on the highest quality data." Per the technical breakdown compiled by MarkTechPost, it's a sparse mixture-of-experts model with 137 billion total parameters and 5 billion active, a 256k context window, text in and text out, derived from MAI-Code-1-Flash. The "Flash" in the name is the whole strategy: it isn't the smartest model in the room, it's the one cheap and fast enough to run constantly. Up to 90% of MDASH tasks route to it, with the hardest 10% escalating to GPT-5.4.

Fourth: the scorekeeper. CyberGym came out of Dawn Song's group at UC Berkeley, published to arXiv in June 2025 (arXiv:2506.02548). It covers 1,507 real-world vulnerabilities across 188 real software projects, all derived from bugs OSS-Fuzz surfaced. The task is brutal by design: given only a text description of a vulnerability and the codebase, produce a proof-of-concept that actually reproduces it. When the paper landed, the best agent-model combinations were hitting roughly 20%. Running the benchmark itself turned up 34 zero-days and 18 historically incomplete patches. Understanding that starting point is how you understand what 96% means about the last twelve months.

Fifth: Anthropic's Claude Mythos, the model Microsoft chose to measure itself against. Announced April 7 as a frontier model built for cybersecurity work, it scored 83.1% on CyberGym's vulnerability reproduction benchmark in Anthropic's own red team assessment, against 66.6% for Opus 4.6. In Firefox testing it produced working exploits 181 times. Anthropic decided it was too capable for general release and restricted it to roughly 40 hand-picked organizations under Project Glasswing; the UK AI Safety Institute published its own separate evaluation. When Microsoft writes "+12 points above Mythos," that's the bar it's choosing to be measured against.

What actually shipped — and what conspicuously didn't

Structurally, Perception runs on playbooks. Per Microsoft Learn, a playbook is a reusable template that assigns a team of specialized agents a set of objectives and orchestrates their actions across the workflow. You can also just type into Chat in plain language — Perception picks the matching playbook, pre-populates the inputs, and runs it inline. Inside the Defender portal you get five sections: Overview, New Chat, Sessions, Agents, and Playbooks. Admins choose which agents are enabled, configure each agent's identity and role, and control who can run or even view sessions.

Six agents are actually named in the preview documentation. Red team gets exactly one: the Recon Agent, which performs attacker scouting to map your environment and surface attack paths, choke points, valuable assets, configuration issues, and excess permissions. Blue team gets four. The Triage Agent classifies alerts as true or false positives with written reasoning, and learns from context and feedback. The Threat Intelligence Agent extracts attack patterns and indicators and works out how to defend against them. The Attack Investigation Agent reconstructs the full attack story from correlated alerts and signals — verdicts, timelines, techniques, indicators of compromise, affected entities. The Detection Authoring Agent finds coverage gaps and writes new detection rules. Green team gets one: the Posture Prioritization Agent, which ranks posture issues by real-world risk, exposure, exploitability, and asset criticality.

Notice the asymmetry. Four blue, one red, one green — and the single green agent doesn't fix anything. It decides what to fix first. The launch blog said green team agents "take corrective actions and strengthen defenses across the environment." What made it into the August 3 preview is prioritization. Autonomous remediation is not in this release. Microsoft's staged plan: reversible moves like isolating a machine arrive later this year, while riskier moves like patching a host stay under human approval. The product page states the rule in one line — every high-impact action stays under human sign-off.

Then there's billing. Perception is consumption-priced in Security Compute Units, and Microsoft is explicit that different agents burn SCUs at different rates depending on task intensity. This unit has history. As CNBC reported in March 2024, Microsoft priced Security Copilot at roughly $4 per provisioned SCU per hour, and that model generated real friction in the market. Montenegro flagged precisely this: watch whether bills stay predictable once teams run these loops at scale, or whether sticker shock slows adoption.

Item Detail Basis
Announced July 27, 2026 (Hayete Gallot, EVP Microsoft Security) Official Microsoft Blog
Public preview August 3, 2026, inside the Microsoft Defender portal Microsoft blog + product page
Agent structure Red (expose paths) / Blue (detect, triage, investigate) / Green (remediate, harden), closed loop Microsoft Learn overview
Agents named in preview Recon 1 / Triage, Threat Intel, Attack Investigation, Detection Authoring 4 / Posture Prioritization 1 = 6 total Microsoft Learn agent categories (updated 2026-07-31)
New in-house model MAI-Cyber-1-Flash — first Microsoft model purpose-built for cyber Microsoft AI announcement
Model specs 137B total / 5B active sparse MoE, 256k context, text-only MarkTechPost technical writeup
CyberGym score 95.95% for MDASH + MAI-Cyber-1-Flash + GPT-5.4 Microsoft AI announcement
vs prior config May 2026 MDASH scored 88.45% → +7.5 points Microsoft Security Blog (May 12)
vs competitors Four competing systems charted at 83.2–85.6%; +12 points above Mythos Microsoft AI announcement
Cost ~50% savings vs the MDASH config in market, routing up to 90% of tasks to Flash Microsoft AI announcement
Benchmark size CyberGym: 1,507 real vulnerabilities across 188 projects arXiv:2506.02548, CyberGym site
Autonomous remediation Not in preview. Reversible actions like machine isolation later this year; patching stays human-approved Microsoft staged rollout, Futurum analysis
Billing Consumption-based Security Compute Units, per-agent burn rates Microsoft product page

The row to read carefully is 95.95%. That is not MAI-Cyber-1-Flash's solo score. It's the score of a system configuration — the MDASH harness, its routing logic, and OpenAI's GPT-5.4 all included. Microsoft's own May framing ("the harness does the work, and the model is one input") makes this internally consistent, but compressing it to "Microsoft's model beat Anthropic by 12 points" is a misread. The accurate version: putting our model into our system raised the system score 7.5 points and cut cost roughly in half. And that system still hands its hardest 10% to an OpenAI model. That's why the in-house-model narrative and the multi-model narrative sit side by side in the same announcement.

Who actually gains

The most direct beneficiary is the understaffed SOC. Alert triage is the most tedious, most error-prone job in security operations. Most alerts are false positives, a human still has to open each one, and the miss that matters happens when a third-shift analyst is 200 tickets deep. If the Triage Agent can classify true versus false with written reasoning, and the Attack Investigation Agent can stitch scattered alerts into one timeline, that isn't "AI replaces analysts" — it's throughput on first-pass classification. Google Cloud makes a comparable pitch for its agentic SOC, claiming a typical 30-minute manual analysis compresses to 60 seconds. Same direction of travel.

The second beneficiary is any org already deep in the Microsoft stack. If you're on E5, running identity through Entra and endpoints through Defender, Perception isn't a new vendor contract — it's a new tab in a portal you already stare at. That's the entrenchment Montenegro was pointing at, and it matters more than feature comparisons, because security purchases are decided by procurement friction and integration cost far more often than by benchmark tables. Agents themselves are now table stakes across AWS, Google, Cisco, CrowdStrike, Palo Alto Networks and SentinelOne. Once everyone has agents, the differentiator moves to what those agents are wired to actually touch.

The third beneficiary is less obvious but real: open-source maintainers. What MDASH-class systems actually do is find vulnerabilities in codebases and prove them reproducible. Google DeepMind's CodeMender upstreamed 72 security fixes to open-source projects in its first six months, and Big Sleep found an SQLite flaw (CVE-2025-6965) that Google's threat intel indicated was about to be exploited — cut off before use. When automated vulnerability discovery tilts toward defenders, the burden on the handful of people holding critical libraries together genuinely drops.

Now the awkward side. Standalone vulnerability scanning vendors just got handed a problem, because Microsoft is advertising "half the cost" as a headline. The moment a hyperscaler makes 50% cost reduction the pitch, every competitor selling the same job at a higher price gets that sentence read back to them at renewal. Finance teams have a different problem: SCU consumption billing is hard to forecast, and agents are by nature things that run continuously and keep looking. The industry already learned this lesson with Security Copilot, so expect procurement to negotiate spend caps during the preview rather than after.

And don't miss the obvious one: the biggest beneficiary of a preview without autonomous remediation is Microsoft. Shipping without the autonomy isn't modesty, it's a data strategy. Every proposed action a human approves or rejects, across thousands of real customer environments, becomes labeled training and justification data for the question "when is it safe to let this run unsupervised?" The roadmap promise of automated machine isolation later this year is only executable after that dataset exists.

What happened the last time people tried this

Start with what worked. Google is the cleanest case of automated vulnerability discovery producing real outcomes. Big Sleep, built jointly by DeepMind and Project Zero, found its first real-world vulnerability in November 2024, and later paired with threat intelligence to kill that SQLite bug before attackers used it. CodeMender went further, rewriting vulnerable code rather than just flagging it, upstreaming 72 fixes in six months. The transferable lesson isn't the count — it's the deployment shape. Google never sold this as fully automatic patching. It went inside a human-reviewed pipeline, built a track record, then widened scope. Which is precisely the order Microsoft is following now.

Second success, and it's Microsoft's own: the May results. MDASH surfacing 16 vulnerabilities in the Windows networking stack, four of them Critical RCEs, means a system found things humans had missed in one of the most heavily reviewed codebases on earth. Microsoft also reported a controlled test where all 21 planted vulnerabilities were found with zero false positives, plus 96% recall on historical CLFS vulnerabilities and 100% on tcpip.sys cases from a five-year MSRC database. Those results carry more weight than a benchmark number, because benchmarks have answer keys and production codebases don't.

Now the failures. Lesson one is about price. When Security Copilot went generally available in April 2024 with $4-per-hour SCU consumption billing, the industry reaction was "impressive, unbudgetable." Security budgets are set annually and fixed; consumption billing spikes exactly in the months when incidents spike. Perception reusing that unit means reliving that friction — and this time the meter is attached to agents that run themselves, so the variance is worse.

Lesson two is about blast radius. In July 2024, a faulty CrowdStrike Falcon content update bricked Windows machines worldwide. That wasn't an attack. It was one automated change, pushed by a security product, that grounded airlines and stalled hospitals. Autonomous remediation means delegating that class of authority to an AI's judgment. Microsoft drawing the line at "reversible actions first, patching only with approval" is that lesson encoded as policy: never put revocable and irrevocable actions in the same automation tier.

Lesson three landed yesterday. JFrog Research's post "SQLite Critical CVEs or LLM Slop?" hit 686 points on Hacker News on August 3, arguing that a large share of AI-auto-generated vulnerability reports filed as critical are low-severity or poorly substantiated, and that this is corroding trust in the CVE database. That's a warning aimed squarely at systems like Perception. The real bottleneck in automated vulnerability discovery was never finding things — it's proving the thing you found is real. That's why MDASH has explicit Validate and Prove stages, and why CyberGym demands a reproducing proof-of-concept instead of a description. Whether the number is 96% or 88%, what gets judged in production is whether one false positive burns two days of an engineering team's week.

How the competition swings back

CrowdStrike is already standing on this ground. It has pushed the agentic SOC hard under the Charlotte AI banner, shipping seven agents at once to build what it calls an agentic security workforce, wrapped in AgentWorks — a no-code platform where teams define an agent's mission, data and authorized actions in plain language — and Charlotte Agentic SOAR for orchestration and governance, with a partner bench that includes Accenture, Deloitte, Kroll, Salesforce and Telefónica Tech. The philosophical split with Microsoft is clean. CrowdStrike says build your own agents. Microsoft says turn on our playbooks. Customization freedom versus integration convenience, same argument the industry has been having for two decades.

Google comes from a different angle: Wiz, Gemini, Mandiant and Google Security Operations bundled into an agentic defense story, with triage and investigation agents pitched on that 30-minutes-to-60-seconds compression. Google's sharpest asset is threat intelligence. Its threat intel team publishes ongoing analysis of how adversaries are actually using AI for vulnerability exploitation and initial access — the kind of ground-truth corpus that makes defensive agents less theoretical. That means this contest resolves less on "who has better agents" and more on "who feeds real attack data into their agents fastest."

Palo Alto Networks holds a card the others don't: the May 7 campaign itself. Unit 42 is the team that reconstructed an autonomous attack agent session by session and published it. "We have seen AI-driven offense in the wild, at the log level" is a sales sentence nobody else can say the same way right now. Cortex XSIAM converges SIEM, XDR, SOAR, attack surface management and threat intel into one platform, so what Microsoft does inside the Defender portal, Palo Alto does inside XSIAM. What Palo Alto doesn't own is the operating system and the identity directory, which caps how far its actuators reach.

Anthropic plays at an entirely different layer. Mythos isn't a product, it's a capability, and restricting it to roughly 40 organizations under Project Glasswing is a positioning statement: this is too sharp to sell broadly. For Microsoft that's both a threat and an opening. Threat, because the most capable cyber model sits with a competitor. Opening, because almost nobody can buy it. Microsoft's counter-argument — a system that routes the right model to the right task beats one very strong model — is economically strong and simultaneously an admission that on the hardest problems it still rents frontier capability from OpenAI.

And then there's the competitor nobody names: the do-it-yourself stack. The Unit 42 report showed the offensive version of this already working with one MIT-licensed agent framework and one cheap model API. The defensive version isn't harder. Budget-constrained orgs will seriously evaluate building their own harness instead of eating an SCU bill, and the mere existence of that option puts a ceiling on what commercial agentic security can charge.

So what actually changes

For regular users, nothing visible. This is enterprise software; it will never appear in your consumer account settings. The indirect effect is real though: if the services you use run on Microsoft's stack, their security team may spend less time shoveling alerts and more time on actual threats. The bad-case version is worth imagining too — once automated machine isolation switches on later this year, a false positive could be the reason your work laptop gets cut off the network one morning. That's typically the day people understand why the human approval gate mattered.

For developers and security practitioners, now is the moment to actually touch the preview, and there are three things worth measuring. First, false positive rate — specifically, whether the Triage Agent's written "reasoning" is genuine justification or plausible post-hoc narrative. This is exactly the context behind the "Don't be a meat proxy" essay that took 1,661 points on Hacker News yesterday: passing AI output downstream without verifying it adds zero value. Build a sampling process from day one that reopens a share of alerts the agent closed as benign. Second, SCU burn. If you don't measure which playbooks cost what during preview, you'll have no negotiating position at general availability. Third, the ergonomics of the approval queue. If agents throw 40 approval requests a day at a human, that human will start approving everything by reflex. Automation usually fails there, not in the model.

For investors and policy people, different signals. On the investing side the load-bearing number is "50% cost savings." Microsoft replacing up to 90% of frontier model calls with its own small specialized model means the cost structure of AI products is shifting from "which model do you use" to "how do you route." That generalizes far past security — it applies to every agentic product being built right now. At the same time, the fact that the hardest 10% still goes to GPT-5.4 is another data point in reading the Microsoft-OpenAI relationship. On the policy side the harder question is that a red team agent autonomously probing for attack paths is, in code terms, nearly indistinguishable from an offensive tool. How long the "it's defensive, so it's fine" line holds up in export control and dual-use debates is genuinely unclear.

If you run a security organization, here's the compressed version. What opened on August 3 isn't a finished product — it's an approval workflow. Before getting excited about autonomous defense, check whether your org has a written rule for who approves an AI-proposed action and on what basis. If that rule doesn't exist when automated isolation switches on later this year, accountability floats. And writing that rule is your job, not your vendor's.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you're an individual, nothing directly. This is something companies enable inside Defender, and it won't touch consumer products. But if you work anywhere near security or infrastructure, the preview has been open since August 3 and you can go poke at it — and the things worth judging are the false positive rate and the SCU bill, not the demo.

— Why is this happening right now? Three days ago Unit 42 published its analysis of an autonomous AI attack campaign, and yesterday Hacker News spent the day arguing about AI-generated vulnerability slop polluting the CVE database. Offensive automation just got documented in the wild, which is the best possible moment to announce defensive automation. That said, MDASH itself has been public since May, so this isn't a rush job assembled in response to the Unit 42 report.

— Is Microsoft actually ahead of the competition? Too early to say. The 95.95% CyberGym figure is Microsoft's own self-reported number for a system configuration, and no independent verification has been published. That configuration also includes OpenAI's GPT-5.4, so reading it as a pure in-house-model win overstates it. CrowdStrike and Google both already shipped agentic SOC offerings, and the real gap will probably show up not in benchmarks but in how much of your environment each vendor's agents are actually wired to touch.

Sources

Numbers are as of announcement and may change.