GPT-6 Cyber vs MAI-Cyber 1.1 Flash: A Model You Rent Against a Model You Can't Buy

The two most capable security models released in the past ten days are not sold the same way, and that difference decides the comparison before any benchmark does. GPT-6 Cyber, released by OpenAI on 5 November 2026, is a model with an API id, a published rate card of $20 per million input tokens and $100 per million output, a 1,050,000-token context window, and a system card running to dozens of evaluations. MAI-Cyber 1.1 Flash, released by Microsoft AI on 27 October 2026, has no API, no price, no parameter count, no context window and no benchmark. It exists as a selectable profile inside MDASH, Microsoft's multi-agent vulnerability-scanning harness, for customers who have already been verified.

So the honest framing is not "which model is better." It is: one of these is an instrument you can call and meter, and the other is a component inside a service you buy scans from. Most comparison posts will put 48.45% on ExploitGym next to "comparable performance" and call it a day. That number pairing is meaningless, and understanding why is more useful than the pairing itself.

What each one actually is

GPT-6 Cyber is a first-class model in OpenAI's catalogue. It takes text and image input, returns text, supports streaming, function calling and structured outputs, runs on the Responses and Chat Completions endpoints only — Batch, Realtime and Assistants are not supported — and does not support fine-tuning. Its context is the same 1.05M tokens as the rest of the GPT-6 line and its maximum output is 128K. You can put it behind a key, in a pipeline, with your own orchestration on top.

MAI-Cyber 1.1 Flash is not that. Microsoft's announcement describes it as "a more focused model" and says nothing else structural. Existing MDASH customers pick the "MAI Cyber 1.1 Flash profile" when starting a scan; new customers request access. There is no model card, no endpoint, and no way to send it a prompt of your own design outside the harness. What you are choosing between, at the level a buyer experiences it, is a model and a scanning product.

• Form — GPT-6 Cyber: standalone API model. MAI-Cyber 1.1 Flash: a model profile inside MDASH.

• Price — GPT-6 Cyber: $20.00 input / $100.00 output per million tokens, $2.00 cached input, $25 cache writes. MAI-Cyber 1.1 Flash: no published price; Microsoft quotes only "18% lower cost to complete the same scans" than MAI Cyber 1 Flash.

• Context — GPT-6 Cyber: 1,050,000 tokens, 128,000 max output. MAI-Cyber 1.1 Flash: undisclosed. The 256K figure circulating for this family belongs to the July MAI-Cyber-1-Flash card, not to 1.1.

• Parameters — GPT-6 Cyber: undisclosed. MAI-Cyber-1-Flash was published at 137B total and 5B active in a sparse mixture-of-experts; the 1.1 release publishes no architecture at all.

• Access — GPT-6 Cyber: API and Codex for approved Daybreak Red customers, with IP allowlisting and monitoring. MAI-Cyber 1.1 Flash: MDASH only, for verified customers, on request.

• Benchmarks — GPT-6 Cyber: a full system card. MAI-Cyber 1.1 Flash: none. Not one standalone score.

The disclosure gap is the story

When MAI-Cyber-1-Flash launched on 28 July 2026, Microsoft led with capability: a 95.95% CyberGym figure for MDASH running the model, against a range of 83.2% to 85.6% for four other systems, plus a 50% cost reduction against its previous GPT-heavy configuration. The successor leads with cost alone — 18% cheaper per scan, performance described only as "comparable" — and adds two rounded adoption figures: nearly nine in ten follow-up scans stay on the MAI profile, and MAI Cyber now accounts for almost 50% of all MDASH scans.

That is three numbers, all about the harness, none about the model. A release that declines to publish a benchmark while asking customers to migrate is telling you something, and the correct response is to ask what the 18% is measured against and what it costs in missed findings. Microsoft does not say. It gives no token accounting, no escalation rate, no scan volume beyond "thousands," and no false-positive or false-negative rates for either model.

The contrast with OpenAI is stark in the other direction, and not entirely flattering either. GPT-6 Cyber's system card is enormous, but every figure in it is vendor-reported, on evaluations OpenAI designed or adapted, against a baseline OpenAI also sells. Volume of disclosure is not the same as independence. What OpenAI has that Microsoft does not is specificity: you can read exactly which task the model failed and by how much.

Offensive and defensive are different products

The most consequential difference is not price or disclosure. It is what the models are permitted to do.

GPT-6 Cyber is built for authorised offensive work. On OpenAI's cyber refusal evaluations it completed 96% of exploit-development tasks and 97% of red-teaming tasks, and it is the model behind the Linux kernel research that produced working exploits for 948 unique privilege-escalation vulnerabilities. Its headline benchmark, ExploitGym, measures intended-exploit success: 48.45%, against 42.43% for GPT-6 Astra and 32.1% for GPT-5.6 Cyber.

MAI-Cyber-1-Flash was trained defensive-only, and Microsoft made that explicit in July by publishing zeroes on ExploitGym across kernel, userspace and browser — zero by design, not by failure. Nothing in the 1.1 announcement suggests that changed. MDASH's job is to find, validate and remediate vulnerabilities in software you own, not to produce weaponised exploits.

That makes the two models non-substitutes for most buyers. A red team that needs a working exploit chain cannot use a defensive-only model at any price. A regulated enterprise that wants scan coverage and an audit trail does not want a permissively-trained offensive model on its network, which is precisely why OpenAI gates GPT-6 Cyber behind Daybreak Red with allowlisting and monitoring.

What a fair comparison would require

If you wanted to compare these two honestly, you would need four things, and three of them do not exist.

• The same task set. CyberGym, which Microsoft used in July, is a public benchmark: 1,507 known vulnerabilities across 188 open-source projects. ExploitGym, which OpenAI uses, measures exploit success. Neither vendor has published the other's benchmark, and MAI-Cyber 1.1 Flash has published no benchmark at all.

• The same unit of work. OpenAI prices tokens, so a scan's cost is a function of your pipeline. Microsoft prices scans implicitly, through MDASH, and reports an 18% delta rather than an absolute. There is no exchange rate between "per million output tokens" and "per scan."

• The same baseline. Microsoft's 18% is against MAI Cyber 1 Flash, not against the GPT-heavy configuration that preceded it. The family already banked a large saving in July; 1.1 adds 18% on top of an already-reduced baseline. Two figures quoted together look far larger than the actual change.

• Independent reproduction. Neither has any. Both sets of numbers come from the vendor that sells the model, which is normal for a ten-day-old release and still means nobody outside the two companies has checked.

The one thing you can compare is the mechanism each vendor claims. Microsoft says the 1.1 model takes on more of the work itself, so MDASH escalates less often to larger models — a plausible route to an 18% per-scan saving that says nothing about whether the model finds more. OpenAI says GPT-6 Cyber adheres to scope better, measured on a honeypot service it exploited in 0.07% of tests without safety instructions and 0% with them, against 5.51% for GPT-5.6 Cyber. Both are claims about behaviour inside a harness. Only one of them comes with the eval.

Where each one fits

Take MAI-Cyber 1.1 Flash if you are already an MDASH customer and your job is finding and fixing vulnerabilities in software you control. The switch is a dropdown, the cost direction is down, and the operational risk is close to zero because the harness, the reporting and the escalation logic do not change. The thing you cannot do is verify the capability claim, so the migration is a bet on Microsoft's internal evaluation rather than on evidence you can inspect.

Take GPT-6 Cyber if you have an authorised offensive workflow and Daybreak Red approval. You get a model you can wire into your own tooling, a published rate card you can forecast against, and a system card detailed enough to argue with. You also get a $100 output price and a gated key, so the pipeline design has to be deliberate about which stage runs on the expensive model.

For everyone else — the majority, who are not in Daybreak Red and not in MDASH — neither is available today, and the practical question is what to run while you wait. Neither model is in the OrcaRouter catalogue and neither has a model page there. What we do route is the general tier those pipelines spend most of their tokens on: GPT-6 Astra, GPT-6.1 Sol, GPT-6 Sol and GPT-6 Luna, through one API key across more than 200 models at provider list price with 0% markup and automatic failover. Triage, patch drafting, report writing and the code review that consumes findings are general-purpose work, and running them on a $2/$10 model instead of a $20/$100 one is where a security budget actually goes.

The open question

Both releases point at the same unresolved problem, from opposite directions. OpenAI published a million-dollar scan that found 948 exploitable kernel bugs and, ten days later, 61 patches upstream — a discovery-to-fix ratio that no benchmark captures. Microsoft published a cheaper way to run the same scans without saying whether they find more. One company is measuring how much it can find; the other is measuring how little it can spend finding it.

The comparison that will actually matter is not GPT-6 Cyber against MAI-Cyber 1.1 Flash. It is whether either pipeline can convert findings into fixes fast enough to matter. On that question, neither vendor has published a number, and that is the one number a security team should be asking for.