Microsoft and Wiz mind-meld agents catch more than 90% of bugs
Microsoft and Wiz have unveiled rival AI-powered bug-hunting systems that combine multiple large language models to find and fix software vulnerabilities with unusually high accuracy. Both firms say the key to their success is routing different stages of vulnerability analysis to whichever model performs best at that specific task, rather than relying on a single AI system, a lesson with wider implications for how the security industry deploys AI going forward.
Wiz's Project Atlas achieved a 90.9 percent success rate on the CyberGym benchmark and has already uncovered more than 200 zero-day flaws in widely used open-source code, pairing Claude Opus 4.6 with GPT-5.5 and planning to add Gemini next. Microsoft's MDASH harness scored even higher at 95.95 percent by combining its in-house MAI-Cyber-1-Flash model, which handles roughly 90 percent of tasks, with GPT-5.4 for the toughest remaining cases; both beat standalone rivals from OpenAI, Anthropic and Google, which scored between 83 and 86 percent. Microsoft AI chief Mustafa Suleyman said the multi-model approach also roughly halves customer costs compared with using a single frontier model throughout.
In short
- Microsoft's MDASH and Wiz's Atlas top 90% accuracy hunting software bugs
- Both combine multiple AI models, each handling tasks it does best
- Approach also cuts costs by around half, Microsoft says
Explained simply
Software vulnerabilities are weaknesses in computer programmes that criminals and hostile actors can exploit to steal information, disrupt systems or cause harm. Finding and fixing these flaws before they are discovered and weaponised is a critical priority for technology companies and organisations worldwide. Security teams have traditionally relied on specialist staff, code review and automated scanning tools to identify vulnerabilities.
Technology companies are increasingly using artificial intelligence – computer systems trained to perform tasks like identifying patterns in code – to automate the process of finding vulnerabilities. Companies including Microsoft and the cybersecurity firm Wiz have developed AI systems for this purpose. A new approach involves combining multiple different AI systems and directing each analysis task to whichever performs best, rather than relying on a single system.
The combined approach appears to offer improvements over using a single AI system alone, both in detecting vulnerabilities and in cost. This suggests that the security industry may move towards combining multiple AI systems rather than relying on one advanced system throughout. The lesson may also apply to how artificial intelligence is deployed across other fields.