vulnerability detection

Bilingual

MAI-Cyber-1-Flash inside MDASH
2 months ago
- MAI-Cyber-1-Flash is a compact, code-heavy security model designed to find challenging vulnerabilities in complex codebases.
- It is integrated into MDASH, a multi-agent vulnerability identification and remediation harness, delivering world-class performance at 50% of the cost of leading models.
- The system handles up to 90% of tasks efficiently, reserving larger models for the hardest 10%, achieving a 96% score on CyberGym (12 points above Mythos).
- The announcement also includes Perception, an agentic security system for continuous monitoring, patching, and closing new threat vectors.
- Microsoft's advantage comes from decades of security data, trillions of daily signals, and a reinforcement learning loop that continuously improves the model.
- Safety is built in with enterprise-grade controls, AI Red Team evaluations, and independent third-party assessments.
Gemini 3.5 Flash Cyber
2 months ago
- Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned from 3.5 Flash for efficient vulnerability discovery, validation, and patching.
- The model addresses the dual-use nature of AI by launching as a limited-access pilot for governments and trusted partners via CodeMender.
- 3.5 Flash Cyber excels in exploring large codebases, enabling multiple invocations to analyze more code paths than single large models.
- Benchmark tests show 3.5 Flash Cyber achieves competitive performance on CyberGym, surpasses mainline models on Big Sleep and Chrome commit scanning, and finds more unique vulnerabilities in V8 Engine.
- Real-world use at Google uncovered critical vulnerabilities in Chrome, Android, Cloud, Ads, and YouTube, including remote code execution and memory corruption.
- The model is cost-efficient and scalable, making it ideal for frequent scans and integration into development pipelines.
VulnHunter: Capital One's agentic AI code security tool
2 months ago
- Capital One has released an open-source AI security tool named VulnHunter to proactively detect and fix code vulnerabilities from an attacker's perspective, in response to AI-enhanced threats.
- VulnHunter features a falsification engine to minimize false positives, an attacker-first forward analysis to simulate real attack paths, and evidence-backed remediation modeling to provide targeted fixes.
- The tool is designed with a developer-first mindset to integrate smoothly into workflows, and Capital One open-sourced it to foster collective defense across the tech community.
GLM 5.2 beats Claude in our benchmarks
3 months ago
- GLM 5.2, an open-weight model from Zhipu AI, achieved a 39% F1 score on IDOR detection, surpassing Claude Code (32%) and costing about $0.17 per vulnerability found.
- The experiment compared models with and without a custom harness (scaffolding); GLM 5.2 performed well with only a prompt, while Semgrep's multimodal pipeline with a harness scored higher (53–61% F1).
- Key advantages of GLM 5.2 include being open-weight (MIT license), competitive coding performance (e.g., 81.0 on Terminal-Bench 2.1), and low cost relative to frontier models.
- IDOR (Insecure Direct Object Reference) vulnerabilities are common and challenging to detect due to their business-logic nature, requiring reasoning across files without clear dangerous functions.
- The study highlights the importance of harnesses in vulnerability detection, showing that performance depends on both model capabilities and the supporting infrastructure.
- Economic factors like cost per bug are crucial for scalability, with GLM 5.2 offering a cost-effective solution for security tasks.

vulnerability detection

MAI-Cyber-1-Flash inside MDASH

Gemini 3.5 Flash Cyber

VulnHunter: Capital One's agentic AI code security tool

GLM 5.2 beats Claude in our benchmarks