Multi-agent AI detects 90% of bugs: Microsoft and Wiz mark a before and after

What happened?

Microsoft and Wiz, a company owned by Google, have announced multi-agent artificial intelligence systems for detecting and fixing software vulnerabilities. Microsoft's system, called MDASH, combines a small proprietary model (MAI-Cyber-1-Flash) with GPT-5.4, achieving a 95.95% success rate on the CyberGym benchmark. Wiz, for its part, presented Project Atlas, which uses Claude Opus 4.6 and GPT-5.5, reaching 90.9% and discovering more than 200 zero-day vulnerabilities in open source. Both systems far surpass individual models like GPT-5.5 Cyber (85.6%) or Mythos 5 (83.8%).

According to The Register, the secret to the success of both systems lies in using the right model for each security task. MDASH uses MAI-Cyber-1-Flash to handle up to 90% of routine tasks, reserving GPT-5.4 for the remaining 10% that is more complex. Wiz, meanwhile, plans to incorporate Gemini into Atlas, leveraging the recent collaboration with DeepMind on Gemini Flash Cyber. These results demonstrate that orchestrating multiple models outperforms any single model, marking a milestone in bug-hunting automation.

Why is it important?

Historically, finding and fixing security bugs has been a manual, slow, and costly process. A 2023 study estimated that the average time to patch a critical vulnerability was 97 days, exposing companies to risks for months. This advance shows that combining specialized models can automate a large part of the process, with success rates above 90%. Furthermore, by using smaller models for routine tasks and reserving large ones for complex cases, costs are reduced by up to 50%, according to Mustafa Suleyman, CEO of Microsoft AI. This makes continuous and scalable security economically viable, allowing frequent scans even in agile development environments.

The market impact is significant: according to Gartner, global spending on software security exceeded $200 billion in 2024, and AI automation could reduce operational costs by up to 30%. Companies like Wiz have already shown that it is possible to discover more than 200 zero-days in open source, which previously required elite teams for months. This pressures other security vendors, such as CrowdStrike or Palo Alto Networks, to adopt multi-agent approaches to avoid falling behind.

Consequences and context

The multi-agent strategy represents a paradigm shift: no single model is best for everything, and the key is orchestrating several. Wiz plans to add Gemini to Atlas, while Microsoft already integrates its proprietary MAI model with GPT. This pressures other security providers to adopt similar approaches. However, the commercialization of Atlas is not yet planned; for now it is used internally. For companies, this means bug hunting could become faster, cheaper, and more accurate, reducing the window of exposure to critical vulnerabilities.

Historically, vulnerability detection has relied on specialized human teams, with tools like fuzzing or static analysis. However, these methods have limitations: fuzzing finds random bugs but does not guarantee coverage, and static analysis generates many false positives. Multi-agent systems, by combining models with different strengths, offer a more complete solution. For example, MDASH uses red-team agents to find vulnerabilities and green-team agents to fix them, automating the entire cycle. Wiz, for its part, has discovered zero-days in critical projects like OpenSSL and Kubernetes, demonstrating its effectiveness on real code.

However, there are challenges: integrating models from different vendors (Microsoft, OpenAI, Anthropic, Google) poses interoperability and dependency issues. Additionally, benchmarks like CyberGym, although standard, do not cover all real-world scenarios. As Nir Ohfeld, head of vulnerability research at Wiz, noted, "there is no single model that is best at everything, and none stays at the forefront for long."

What readers should know

• Multi-agent systems do not replace human security teams but rather empower them, taking on repetitive and complex tasks. According to Hayete Gallot, EVP of Microsoft Security, the goal is for humans to focus on strategic tasks while AI handles routine detection and patching.
• Effectiveness varies by benchmark; CyberGym is a standard, but it does not cover all real-world scenarios. For example, GPT-5.5 Cyber scored 85.6% on CyberGym, but in Wiz's internal tests, Atlas managed to discover zero-days that other models missed.
• The reduced cost allows for more frequent scans, which is crucial in agile development environments where code changes constantly. Microsoft claims that MDASH can run continuously, with a cost per scan 50% lower than using only large models.
• The combination of models from different vendors suggests a collaborative ecosystem, although it also poses integration and dependency challenges. Wiz is already working on incorporating Gemini, and it is not ruled out that more models will be added in the future.
• The impact on the job market: although it does not replace humans, it changes the skills required. Security professionals will need to understand how to orchestrate and supervise these systems, rather than performing manual bug-hunting tasks.

"There is no single model that is best at everything, and none stays at the forefront for long" — Nir Ohfeld, head of vulnerability research at Wiz.

In conclusion, multi-agent systems like MDASH and Project Atlas represent a significant advance in automating vulnerability hunting. With success rates above 90% and reduced costs, they are paving the way toward more proactive and scalable security. However, their widespread adoption will require overcoming technical and integration challenges, as well as an evolution in the skills of security teams.