Microsoft’s Project Perception entered public preview today with MAI-Cyber-1-Flash inside the company’s MDASH vulnerability system. Microsoft says the configuration scored 96% on CyberGym, 12 percentage points above Mythos, while costing nearly 50% less than its current commercial MDASH configuration.

This morning’s edition also covers secure code generation, a large audit of commercial system prompts, security-alert triage, machine-learning agents, computer-use scaling, cache-replay fidelity, generated-interface evaluation, efficient vision models, long-video sampling, real-time anomaly detection, agricultural robot navigation, and a new higher-education security conference. The research papers were submitted July 30; their results are author-reported and have not been independently reproduced.

What changed overnight

  • Project Perception entered public preview on August 3. Its first scenario uses MAI-Cyber-1-Flash and MDASH for software vulnerability management; the underlying MDASH system had previously been in a limited private preview.
  • SecurED Conference 2027 has confirmed April 7–9 dates in Atlanta, with individual tickets on sale and sponsor or exhibitor participation open.

Security agents, code, and prompt accountability

Microsoft reports 96% on CyberGym for Project Perception

Project Perception combines Microsoft’s cybersecurity model with MDASH, a system that assigns specialized agents to locate, debate, deduplicate, prove, and help remediate software flaws. Microsoft says the new MAI-Cyber-1-Flash configuration reaches 96% on CyberGym, which contains 1,507 vulnerability-reproduction tasks from 188 open-source projects. The company reports a 12-point advantage over Mythos and nearly 50% lower cost than its current commercial MDASH configuration.

The result is a Microsoft-run system test, not an independent product comparison. The company has not published a full price or workload table for the claimed savings. Public-preview customers can now test the vulnerability workflow, while Microsoft says later Project Perception scenarios will cover other security jobs.

MDASH previously used more than 100 agents and generally available models to score 88.45% on CyberGym. Microsoft also reported that the system helped its researchers find 16 Windows vulnerabilities disclosed in May. Project Perception’s 96% result uses the new specialized model inside the surrounding agent system, so it does not isolate the contribution of MAI-Cyber-1-Flash.

CoGate listens to a security model only when it is confident

Minghao Hu and collaborators studied co-decoding, where a smaller security specialist steers a larger code model one token at a time. Existing methods can follow the specialist even when it encounters unfamiliar code and has low confidence. CoGate reduces the specialist’s influence in those cases.

The authors tested CodeGen, DeepSeek-Coder, Qwen-Coder, and StarCoder on HumanEval, a security suite, and CWEval. They report up to a 12.6% gain over CoSec+ on Func-Sec@10, a metric that requires generated programs to be both functional and secure. The paper does not establish that confidence gating catches repository-level vulnerabilities or replaces execution, dependency, and integration tests.

A trained calibrator improves high-confidence security-alert triage

A separate study trained a reasoning model on human-labeled Windows endpoint detections, then trained a second model to estimate whether each reasoned verdict was correct. The classifier reached 82.6% test accuracy. At the high-confidence threshold used for automated triage, the authors report benign recall improving 43.0% and malicious recall improving 18.3% over a direct-label language model.

An untrained confidence judge reduced high-confidence recall to zero. In this test, producing a rationale did not make raw confidence trustworthy; a dedicated calibrator had to learn from the complete reasoning trace. The data come from Windows endpoint alerts and do not measure code review, game moderation, or live incident response.

An audit finds problematic instructions in roughly 40% of commercial system prompts

The AISPA team reviewed 3,249 instructions from system prompts used by 88 commercial AI products. It classified instructions across eight user-facing dimensions and labeled each as protective or problematic. At least one protective instruction appeared in 98.9% of products, but only 24% covered all eight dimensions. Roughly 40% contained at least one instruction that worked against user interests, according to the paper.

System prompts also grew longer and included more protections over time. AISPA evaluates disclosed or obtained prompt text; it does not test whether a product consistently follows those instructions in deployment. Those instructions often govern an agent’s behavior while remaining invisible to users and outside researchers.

Agent training, replay, and evaluation

Frontis-MA1 improves its base model from 39.39% to 60.61% on MLE-Bench Lite

Frontis AI trained a 35-billion-parameter model to draft, improve, debug, and combine machine-learning programs, then reused the same operations in a longer search loop. Under a 12-hour budget per task on one RTX 4090 limited to 12 GB of memory, Frontis-MA1 with OpenMLE-Evo raised Medal Average from 39.39% for its base model to 60.61%. An expanded search with benchmark-independent experience priors reached 71.21%.

The authors say that result exceeded GPT-5.5 with Codex and approached GPT-5.6 Sol and Kimi K3 under their setup. On held-out NatureBench Lite, swapping the trained model into a fixed framework raised Match-SOTA from 50% to 70%; swapping the search framework around a fixed model raised it from 20% to 50%. The weights and OpenMLE stack are public, which makes matched-budget replication possible.

More local computer-use inference often extends the wrong trajectory

Researchers tested Qwen3-VL-8B, Qwen3-VL-30B-A3B, UI-TARS-1.5-7B, and OpenCUA-7B on OSWorld under several ways of spending more inference compute. Longer history improved stability, but gains saturated while failures shifted toward agents declaring success too early. Allowing more steps reduced hard step-limit stops without materially increasing task success.

Splitting planning from action introduced overhead for the local models, and parallel attempts recovered some performance at substantial compute cost. Extra tokens, steps, structure, or parallel runs did not compensate for a policy that kept pursuing an incorrect screen state or goal.

Identical BF16 token prefixes can hide different continuation states

A Qwen2.5-derived system produced different suffixes in 166 of 200 cases when researchers compared continuation from a retained live key-value cache with a fresh prefill of the exact same integer-token prefix. Twenty correctness labels changed, even though aggregate accuracy differed by only one percentage point.

The disagreement returned in a controlled BF16 comparison and disappeared in FP32, where none of the 200 continuations differed. Transplanting all 48 cache layers made every tested divergent output follow the cache donor: 24 of 24 selected cases and 43 of 43 in an outcome-blind replication. A replay tool can therefore reproduce visible tokens while failing to reproduce the decoder state that originally generated them.

Simulated user panels track interface ratings better than one judge

ESPP evaluates a generated interface screenshot through several evidence-grounded user personas, lets their ratings change under bounded social influence, and combines the result with Delphi-style weighting. On the authors’ dataset, correlation with human judgments rose from Pearson r = 0.716 for a single-pass judge to r = 0.922 for the panel.

A prompt ensemble recovered about one-third of that gap, according to the paper. The retained persona ratings also showed that groups could agree on overall model order while disagreeing on particular qualities. These are simulated personas, so the panel cannot replace human review for accessibility, culture, age, or high-stakes design decisions.

Vision and navigation on constrained hardware

MixFrag allocates precision by how much quantization changes each component

MixFrag measures the output change when one Vision Transformer component is quantized, then solves a multiple-choice knapsack problem to distribute bit widths under a fixed budget. On COCO object detection and instance segmentation, the authors report up to 9.6 average-precision points over the previous mixed-precision method in the difficult MP3/MP3 setting.

The method also retained competitive ImageNet-1K accuracy across several Vision Transformer families. It needs a small calibration set and targets post-training quantization; it does not reduce the model’s underlying parameter count or show the same gain on a mobile game renderer.

VisualRouter changes frame sampling according to the question

VisualRouter first labels a long-video question as global or local. Global questions receive a mixture of relevant frames and broad temporal coverage; local questions receive frames selected within detected events. No additional training is required.

With Qwen2.5-VL-7B, the authors report gains over uniform sampling of 5.2% on Video-MME, 7.7% on LongVideoBench, and 11.6% on MLVU. Those are question-answering results. A creator tool would still need to test whether routed frames preserve character state, edits, causality, and transitions that are not named in a query.

PixOOD reaches 75 frames per second on a Jetson AGX Orin

Researchers reformulated PixOOD’s anomaly score and compiled the complete segmentation pipeline with TensorRT. They report 182 frames per second on a desktop RTX 4060 and 75 frames per second on a Jetson AGX Orin, respectively 20 and 18 times faster than the original baseline.

The work targets unexpected objects and regions in autonomous-driving and railway video. It shows that anomaly segmentation can fit an embedded latency budget, but the abstract does not give the accuracy trade-off at those speeds or a power measurement for continuous use.

A traversability alarm raises agricultural navigation success from 0.47 to 0.54

TEA-AgriVLN adds a camera-based traversability estimate to an agricultural vision-and-language navigation agent. When the planned action conflicts with the traversability map, the module asks the decision system to reconsider. On the A2A benchmark, success rose from 0.47 to 0.54 and navigation error fell from 2.91 metres to 2.70 metres.

Agricultural terrain makes traversability dependent on the body and task: a crop row that a small robot can enter may remain unsuitable for a person or a different machine. The alarm improves one benchmark backbone and does not yet establish reliable transfer across robots, seasons, weather, or crop conditions.

Events calendar

SecurED 2027 opens tickets for its Atlanta higher-education fraud conference

SecurED Conference 2027 will run April 7–9 at the Atlanta Airport Marriott Gateway. The organizer is selling individual tickets, with early-bird pricing through September 30, 2026, standard pricing through February 28, 2027, and late pricing listed through April 7. Sponsor and exhibitor participation is open separately without a published deadline.

The conference focuses on fraudulent applications, identity verification, financial-aid integrity, and enrollment security. Its headline dates are April 7–9, while the current detailed agenda also shows a conference-end marker on April 10. The official page therefore contains inconsistent date information; readers booking travel should verify the schedule first.

See the 2027 games and education-technology events calendar.

Watch next

  • Microsoft needs to publish matched Project Perception costs, access conditions, and enough CyberGym configuration detail for the 96% result to be reproduced outside the company.
  • CoGate and the alert-triage model need repository-scale and live-workflow tests that measure missed vulnerabilities, false automation, and developer review time.
  • AISPA can be paired with behavioral tests to determine whether protective prompt text changes product outcomes.
  • Frontis-MA1’s public stack allows equal-hardware comparisons against the named proprietary systems and simpler search baselines.
  • Computer-use evaluations should preserve cache state and record false-success declarations instead of treating token-identical stage replay as equivalent execution.
  • MixFrag, VisualRouter, PixOOD, and TEA-AgriVLN need device-level tests that report accuracy, latency, memory, power, and transfer together.

This article was written with assistance from Wonder Bricks AI Agent and edited by SunnyLabs.