Microsoft Just Beat Anthropic’s Most Hyped Mythos, With 100 Smaller Ones

Recently Microsoft’s MDASH system scored 88.45% on CyberGym, outperforming the overhyped Anthropic’s Mythos (83.1%) and GPT-5.5 (81.8%). It used no single dominant model. It used 100+ specialized agents working in a structured pipeline. Here’s exactly how that works, and what it means.

When Anthropic announced Claude Mythos, tthey said, it is so dangerous that they refused to release it publicly. It could autonomously exploit zero-day vulnerabilities across every major operating system and web browser. Governments were briefed. The White House took notice. The AI security discourse shifted overnight.

Six weeks later, Microsoft shipped a blog post on a Tuesday. No drama, no restricted access program, no congressional briefings. Just a Patch Tuesday announcement and a benchmark number: 88.45% on CyberGym, the public benchmark for AI vulnerability discovery. Mythos scored 83.1%. GPT-5.5 scored 81.8%.

The system that beat them is called MDASH. It is not a model. It is a pipeline of over 100 specialized AI agents, built by the team that won the DARPA AI Cyber Challenge, running on an ensemble of frontier and distilled models that can be swapped out as better ones emerge. The core insight behind it is something the AI industry has been slow to internalize: in complex, domain-specific technical work, the architecture of the system around the model matters more than which model you pick.

“The model is one input. The system is the product.” — Taesoo Kim, VP Agentic Security, Microsoft

Photo by BoliviaInteligente on Unsplash

Why This Benchmark Matters

CyberGym is a public benchmark developed by UC Berkeley researchers. It contains 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source software projects. Each task gives the system a description of a known CVE and an unpatched version of the affected codebase. The system must produce a working exploit that reproduces the vulnerability. This is not a quiz. It is a practical engineering test — the kind of work that takes a skilled security researcher hours or days.

Before MDASH, the leaderboard looked like a frontier model competition: Mythos at 83.1%, GPT-5.5 at 81.8%, with everything else trailing. The assumption embedded in those results, shared across most of the industry was that better scores would come from better base models. Bigger reasoning capacity, larger context windows, more training compute.

MDASH breaks that assumption. It scores 5+ points higher than Mythos, not because it uses a more capable model, but because it runs a fundamentally different kind of system. That is the story worth understanding.

What MDASH Actually Is

MDASH stands for Microsoft Security multi-model agentic scanning harness. It was built by the Autonomous Code Security (ACS) team, which Microsoft assembled specifically to take AI-powered vulnerability research from research curiosity to production engineering at enterprise scale. Several core members came directly from Team Atlanta — the group that won the $29.5 million DARPA AI Cyber Challenge in 2024 by building an autonomous cyber-reasoning system that found and patched real bugs in complex open-source projects.

The system is a five-stage pipeline. Each stage has a distinct purpose, distinct agents, and distinct stopping criteria. No single agent or model runs the whole thing. Here is the pipeline as Microsoft described it:

Pipeline Stage 1: Prepare

Ingests the source target. Builds language-aware indices. Analyzes past commits to draw the attack surface and threat model. This is the forensic groundwork — before any scanning starts, the system builds a structural map of what it is about to audit.

Pipeline Stage 2: Scan

Runs specialized auditor agents over candidate code paths. Each auditor emits candidate findings with a hypothesis and supporting evidence. These agents are constructed from past CVEs and their patches — they have been trained to recognize the specific patterns that have produced real vulnerabilities historically.

Pipeline Stage 3: Validate

A second cohort of agents, the debaters, argue for and against each finding’s reachability and exploitability. This is adversarial by design. An auditor flags something as suspect; a debater tries to refute it. If the debater cannot find a convincing counterargument, the finding’s credibility increases. Disagreement between models is itself a signal.

Pipeline Stage 4: Dedup

Collapses semantically equivalent findings. Multiple agents independently discovering the same bug from different angles should not produce 10 separate tickets. Patch-based grouping is one mechanism used here.

Pipeline Stage 5: Prove

Constructs and executes triggering inputs for bug classes that admit it. The prove stage dynamically validates the pre-condition and formulates bug-triggering inputs to confirm the vulnerability exists. For memory corruption bugs in C/C++, AddressSanitizer (ASan) is used to confirm the primitive.

Three design properties make this pipeline work in practice:

Model ensemble, not model monoculture. No single model is best at every stage. MDASH runs a configurable panel: a SOTA frontier model as the heavy reasoner, distilled models as cost-effective debaters for high-volume passes, and a second separate SOTA model as an independent counterpoint. The point of the ensemble is that disagreement is information — when an auditor flags something and the debater cannot refute it, that surviving finding is more likely real.

Specialist agents, not generalist prompts. Over 100 specialized agents, each constructed through deep research with historical CVE data and their patches. An auditor agent does not reason like a debater agent. A prover agent does not work like a scanner. Each has its own role, prompt regime, tools, and stop criteria.

Extensible domain plugins. Foundation models do not understand Windows kernel calling conventions, IRP and lock invariants, IPC trust boundaries, or component-internal idioms by default — these are proprietary Microsoft codebases not in any training corpus. Plugins inject this context. The CLFS proving plugin, for example, knows how to construct a triggering log file given a candidate finding in the Common Log File System. Teams can also plug in CodeQL databases for static analysis.

What MDASH Found: The May 12 CVEs

Before disclosing the real findings, Microsoft ran MDASH against StorageDrive: a private, never-published sample device driver used internally for offensive security research interviews. The driver contains 21 deliberately planted vulnerabilities: kernel use-after-frees, integer handling issues, IOCTL validation gaps, and locking errors. Because StorageDrive has never been published, there is no possibility a model learned these answers from training data.

Result: 21 of 21 ground-truth vulnerabilities found. Zero false positives.

Microsoft then turned MDASH on the Windows network stack. The May 12 Patch Tuesday included 16 CVEs the system found — 10 kernel-mode, 6 user-mode, the majority reachable from a network position with no credentials:

Source: Microsoft Security Blog, May 12, 2026. Taesoo Kim, VP Agentic Security.

Two CVEs Worth Understanding in Depth

Microsoft published technical deep dives on two of the four critical findings. These are worth reading carefully — not because they are the most severe, but because they illustrate precisely what kind of reasoning capability MDASH has that single-model systems lack.

CVE-2026–33827: Remote UAF in tcpip.sys via IPv4 SSRR

The vulnerability is a use-after-free in the Windows IPv4 receive path, specifically in Ipv4pReceiveRoutingHeader — the function that handles Strict Source and Record Route (SSRR) IPv4 options.

The bug: the function calls a routing lookup, then drops its sole owned reference to the resulting Path object. But it then reuses that same pointer when handling SSRR processing further down the function. If the Path object’s reference count hit zero at the earlier release point — which is possible because three independent subsystems (the path-cache scavenger, explicit flush routines, and interface state-driven garbage collection) can concurrently drop the final reference without holding any lock synchronized with the receive path — the memory can be returned to a per-processor lookaside allocator and reallocated before the function reads it again.

On SMP systems, this is a race-driven use-after-free. It is reachable by a remote unauthenticated attacker sending crafted IPv4 packets with the SSRR option set. The stale pointer dereference can lead to controlled reads and a stronger corruption primitive if the reclaimed allocation is attacker-influenced.

Why single-model systems missed this

The release of the Path reference and its later reuse are separated by non-trivial control flow — an alternate branch, multiple validation checks, and several early-drop conditions. No local pattern within the function makes this look wrong. The decisive signal is outside: the same logical operation appears in ike_D.c with the correct ordering, using the object before dropping the reference. Recognizing the inconsistency requires cross-file reasoning: finding the analogous pattern, aligning intent, and noticing the deviation. A single-shot model without staged cross-file analysis cannot do this reliably. MDASH’s scan stage flags the release/reuse pattern; the validate stage cross-references ike_D.c and confirms the inconsistency; the prove stage constructs the packet sequence that triggers the race.

CVE-2026–33824: Unauthenticated IKEv2 Double-Free → LocalSystem RCE

This is the higher-impact finding. The vulnerability is in IKEEXT, the Windows service that handles IKE and AuthIP keying for IPsec. IKEEXT runs as LocalSystem inside svchost.exe — the highest privilege context on the system, short of the kernel.

The attack path: an unauthenticated attacker sends a crafted IKE_SA_INIT message over UDP port 500 carrying Microsoft’s “IPsec Security Realm Id” vendor-ID payload, followed by a single IKEv2 fragment (RFC 7383 SKF) that reassembles immediately. This triggers a deterministic double-free of a 16-byte heap allocation inside the service. No authentication required. No credentials. Any machine configured as an IKEv2 responder — RRAS VPN, DirectAccess, Always-On VPN infrastructure — is exposed.

The root cause is a classic ownership bug. When IKEEXT reinjects a reassembled fragment back through its receive pipeline, it does not transfer ownership of the buffer correctly, leading two separate code paths to believe they own the same allocation and both call free() on it.

What makes this significant is the combination: pre-authentication, remote, deterministic (not a race), and LocalSystem. That is a clean critical.

The Benchmark Comparison: What the Numbers Mean

The CyberGym benchmark score is the headline, but the internal validation numbers are equally important because they are on Microsoft’s own proprietary code — which no model has seen during training.

Internal validation: CLFS and tcpip.sys recall

MDASH was run against pre-patch snapshots of two heavily reviewed Windows components — clfs.sys and tcpip.sys — and measured against five years of MSRC-confirmed bugs that human researchers previously found. Result: 96% recall on clfs.sys (28 MSRC cases), 100% recall on tcpip.sys. These are the hardest possible targets: private Microsoft code, well-reviewed by expert security researchers, with confirmed ground truth. Recall on these components is a more demanding test than CyberGym because there is no training data contamination possible.

CyberGym benchmark, UC Berkeley. Scores are self-reported by companies. Source: Microsoft Security Blog, May 12, 2026.

One caveat worth stating plainly: the scores are self-reported. Microsoft ran MDASH against CyberGym and published the result. Anthropic ran Mythos and published their result. These have not been independently validated head-to-head on the same infrastructure, same date, same compute budget. CyberGym is a real and respected benchmark, but the comparison is not a controlled experiment. That said, the gap is 5+ percentage points, which is large enough to be meaningful even accounting for methodology variance.

The Architecture Argument: Why This Is More Than a Benchmark Story

The surface reading of MDASH is: Microsoft built a good security tool and got a good benchmark score. The deeper reading is an argument about how AI capability compounds in complex technical domains.

The AI industry has been running one experiment for the last four years: make the model bigger, train it on more data, give it more compute. The Bitter Lesson framing — that scale beats hand-crafted intelligence every time — has been directionally correct for a long time. But the CyberGym result is an early signal that there is a complementary thesis: for tasks that require structured, multi-step reasoning across large proprietary codebases with domain-specific constraints, system design around the model can produce larger gains than the next model generation.

Three things make MDASH’s architecture compelling beyond the benchmark:

Model agnosticism compounds over time. The pipeline is built to be model-agnostic. When a better model ships, Microsoft swaps it into the panel with one configuration change. All the scope files, plugins, agent specializations, and calibrations carry over. The investment in system architecture appreciates as models improve; labs that built monolithic single-model tools have to rebuild when the model changes.

Adversarial validation eliminates noise. The debater cohort arguing against each auditor finding is the mechanism that drives false positives to zero on the StorageDrive test. A single model asked to both find and validate a bug has an incentive problem — it can convince itself a candidate finding is real. Separating the auditor and debater roles, and using a different model for the debater, introduces genuine adversarial pressure.

Domain plugins solve the training data problem. Windows kernel code is private. It is not in any model’s training corpus. Foundation models reasoning about lock invariants and IRP rules in tcpip.sys are reasoning about things they have never seen. Domain plugins — injecting kernel calling conventions, lock semantics, IPC trust boundaries as structured context — bridge this gap in a way that no amount of general pre-training can.

A single model harness tends to miss this bug because the lifetime violation is not locally visible even within the same function. — Microsoft Security Blog, describing why CVE-2026–33827 evaded prior tools

The parallel to what has happened in other engineering domains is useful. In drug discovery, AlphaFold did not replace the entire drug development pipeline — it became a component of it, complemented by wet lab validation, clinical expertise, and regulatory frameworks. In software verification, formal methods tools do not eliminate human reasoning — they provide proof obligations that engineers discharge. MDASH suggests that AI in security is following the same pattern: the model becomes a component of a structured pipeline that preserves human domain expertise via plugins and validation stages while automating the mechanically intensive parts.

What This Means for Mythos

Anthropic’s Mythos is a remarkable technical achievement. Autonomously discovering and exploiting a 17-year-old FreeBSD vulnerability without human involvement after the initial instruction is something that did not exist a year ago. The reason Anthropic restricted it, handing it to 40+ partners for defensive use under Project Glasswing rather than releasing it publicly, reflects a genuinely difficult governance tradeoff, not paranoia.

But MDASH quietly reframes the Mythos moment. The story Anthropic told in April was implicitly: frontier capability lives in the frontier model. The more capable the model, the more dangerous and powerful the security tool. MDASH’s result suggests this framing is incomplete. A system of 100+ specialized agents, running on a mix of frontier and distilled models, with domain plugins and adversarial validation, can outperform a single frontier model on the same benchmark.

This matters for the governance question. If capability in AI security is primarily a function of model scale, then the safety argument for restricting Mythos is strong, keep the most capable model out of adversarial hands, and you contain the risk. But if capability is primarily a function of system architecture, then restricting a single model buys less safety than Anthropic’s framing implies. The techniques to build effective security pipelines — multi-agent orchestration, domain plugins, adversarial validation, are not secrets. They are engineering.

One analyst quoted in CSO Online captured it cleanly: “Microsoft is now operating as platform owner, security vendor, AI infrastructure player, OpenAI partner, Mythos integrator, and agentic security supplier. That is a formidable position. It is also a concentration of influence that security leaders must examine with clear eyes.”

The Defender’s Dilemma

One number from the security context is worth sitting with. According to Mandiant’s M-Trends 2026 report, the mean time from vulnerability disclosure to active exploitation has effectively gone negative — 28.3% of CVEs are now exploited within 24 hours of disclosure, meaning exploit code is available before the patch is. The window for defenders is not shrinking. It has inverted.

In this environment, the operational value of MDASH is not the benchmark score. It is the Patch Tuesday cadence. Microsoft’s VP of Agentic Security stated explicitly that enterprises should expect bigger Patch Tuesdays going forward as AI accelerates vulnerability discovery. The system found 16 CVEs in one scan of the Windows network stack, in code that has been under continuous security review by expert human researchers for decades. The implication is that there is a large inventory of similar bugs waiting to be found, and AI-assisted discovery is now fast enough to meaningfully advance the patch schedule.

The parallel offensive threat is real. The same capability that lets MDASH find CVE-2026–33827 in tcpip.sys lets an attacker’s equivalent system find the next one. The race is now between how fast defenders can discover and patch versus how fast attackers can discover and exploit. AI raises the tempo for both sides, but defenders who have operationalized AI-assisted discovery have a structural advantage: they can run the system on their own code continuously, not just when an attacker probes it.

The Bottom Line

The headline is that a Microsoft system beat Anthropic’s most hyped AI model on a public benchmark. The substance is what that system is: not a bigger model, but a more disciplined architecture. Over 100 specialized agents. Five distinct pipeline stages. Adversarial validation by design. Domain plugins to inject proprietary context that no training corpus contains. Model-agnostic infrastructure that appreciates as models improve.

The lesson is not that models do not matter. A distilled model running the debater role cannot do what a frontier model does as the heavy reasoner. Model quality matters. But for complex, domain-specific technical work at production scale, the architecture of the system around the model is at least as important as which model you choose.

That is a different mental model than the one most of the AI industry has been operating with. And it is the mental model MDASH was built to prove.

Mythos got the headlines. MDASH got the benchmark. The difference is what you build around the model.

Sources

Taesoo Kim. “Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark.” Microsoft Security Blog, May 12, 2026.

Gyana Swain. “Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs.” CSO Online, May 13, 2026.

Todd Bishop. “Microsoft’s multi-agent AI system tops Anthropic’s Mythos on cybersecurity benchmark.” GeekWire, May 13, 2026.

Anthropic. “Claude Mythos Preview.” red.anthropic.com, April 7, 2026.

Anthropic. “Project Glasswing.” anthropic.com/glasswing, April 9, 2026.

Mandiant. “M-Trends 2026 Report.” 2026.

CyberGym Benchmark. UC Berkeley. cybergym.berkeley.edu.