Microsoft Deploys Codename MDASH Agentic AI Scanning to Azure Government

Microsoft’s multi-model agentic scanning system for finding security flaws in software, codename MDASH, has deployed to Microsoft Azure Government, the company announced on September 8, 2026, with preview access available to select US government customers and authorized partners.

A Defender Feature Inside Azure Government

The announcement was authored by Douglas Phillips, President and Chief Technology Officer of Microsoft Specialized Clouds. In Azure Government, MDASH is available as a feature of Microsoft Defender that works with models available within the FedRAMP High-authorized Microsoft Foundry service. Azure Government is a separate, isolated cloud operated by screened US persons, built to meet the compliance obligations of federal, national security, and state and local government customers, including FedRAMP High authorization and Department of War accreditation for controlled and mission-critical workloads. Microsoft said the arrangement allows an agency’s source code, and everything the system learns about it, to remain within a boundary already approved for handling that data.

Microsoft said it has been using codename MDASH on its own software for months, and that customers across national security and civilian agencies are already exploring its capabilities. According to the announcement, agencies are ranking their software by mission importance and working steadily down the list, with a stated goal of 100% code coverage.

How the Agentic Scanner Works

Microsoft describes MDASH as an agentic code scanner that finds and validates exploitable vulnerabilities in source code. Rather than checking code against a library of known patterns, as traditional scanning tools do, the system reads and reasons about software the way an expert security researcher would, following how information moves through a program to determine whether a weakness could actually be exploited. More than 100 specialized AI agents, drawing on a variety of models, work on the same body of code, each trained to recognize a different category of weakness. Their findings pass to a second group of agents whose job is to argue the case, for and against, whether each suspected flaw is genuinely reachable and genuinely dangerous. The harness then merges and deduplicates results and, where possible, demonstrates the flaw rather than merely asserting it, delivering what Microsoft characterizes as a refined and prioritized list of vulnerabilities.

Microsoft’s product documentation lays out a multistage pipeline: a Prepare stage that ranks files by risk using call-graph analysis and code complexity metrics; a Scan stage running role-specific agents such as injection, memory-safety, and auth-bypass auditors; a Validate stage applying taint analysis and multi-model debate to refine confidence and eliminate false positives; and a Dedup stage that consolidates duplicate findings. A May 12, 2026, Security Blog post that first publicly detailed the system described an additional Prove stage, which constructs and executes triggering inputs where the bug class allows it.

Documented capabilities include granular confidence scoring for each finding, AI-generated code fixes through the defender fix command in the Defender CLI, centralized results in Microsoft Security Exposure Management, and connectors for GitHub and Azure DevOps. The documentation states that MDASH operates across codebases generically and supports all major programming languages, with specially tuned expert agents carrying particularly deep expertise in C, C++, Java, and C#.

Reported Results and Prior Development

Microsoft said MDASH scored 96.55 on the public CyberGym benchmark of real-world vulnerabilities and has produced similar results on first-party code validated against the company’s historical vulnerability cases.

The May 12 post reported that the harness found all 21 deliberately planted vulnerabilities with zero false positives on StorageDrive, a private sample driver Microsoft uses when interviewing offensive security researchers. It reported 96% recall against 28 confirmed Microsoft Security Response Center cases in the clfs.sys Windows component and 100% on seven cases in tcpip.sys, each spanning five years, and an 88.45% score on CyberGym’s corpus of 1,507 real-world vulnerability reproduction tasks, which Microsoft said was the highest score on the benchmark’s published leaderboard at the time. The same post said the system helped researchers find 16 new vulnerabilities across the Windows networking and authentication stack for the May 12, 2026 Patch Tuesday, including four Critical remote code execution flaws in components such as the Windows kernel TCP/IP stack and the IKEv2 service. At that point the system was in a limited private preview with a small set of customers.

MDASH was built by Microsoft’s Autonomous Code Security team, whose members include engineers from Team Atlanta, the team that won the DARPA AI Cyber Challenge with an autonomous cyber-reasoning system that found and patched real bugs in open-source projects.

On August 13, 2026, Microsoft introduced MAI-Cyber-1-Flash inside MDASH, a compact security model derived from the company’s MAI-Thinking-1 lineage, in a post authored by Mustafa Suleyman and Hayete Gallot. Microsoft said the model is designed to handle up to 90% of scanning tasks, reserving GPT-5.4 for the 10% of exceptionally hard tasks, and that the combination delivers a 50% cost saving compared with Microsoft’s best model combination previously offered in MDASH. The company reported a 96% CyberGym any-crash score for the combined system, with a clarification noting a 90.4% target any-of score and an 86.3% final-submission score. Microsoft said the model was evaluated by its AI Red Team, tested through automated and expert-led adversarial exercises, and independently assessed by a third party.

Multi-Model Design and Threat Framing

Microsoft said the harness design is the key differentiator: a system that directs and coordinates whichever models are best for a specific task, allowing it to adopt newer models as they arrive without rebuilding, so that everything an agency has invested downstream of the system carries forward. The government announcement said the newest addition to the MAI model family is expected to cut the cost of an individual scan roughly in half.

The announcement framed the release around threat actors investing in AI capabilities, arguing that the only durable advantage available to defenders is time, meaning the gap between when a weakness can be found and patched and before someone else finds it. Organizations seeking access are directed to contact their Microsoft account team about MDASH in Azure Government.