Microsoft unveiled Project Perception on July 27, 2026, an AI cybersecurity system built around teams of specialized agents designed to find, evaluate, and fix vulnerabilities faster than human security teams or attackers can act. The system enters public preview inside Microsoft Defender on August 3.
Three agent classes doing a security team’s job
Project Perception coordinates three classes of agents: red-team agents that hunt for the paths an attacker could take through a customer’s environment, blue-team agents that investigate findings and judge which risks actually matter, and green-team agents that carry out fixes and harden defenses. “Project Perception is based on a simple idea: effective defense requires continuous understanding of how an attacker sees the world, how a defender evaluates risk and how protections are improved over time,” Microsoft said in the announcement. Hayete Gallot, executive vice president of Microsoft Security, framed the push in terms of speed: “We need to make sure that the defenders can defend at the scale and the speed of the attackers.”
A purpose-built model, backstopped by GPT-5.4
The agents run on MAI-Cyber-1-Flash, Microsoft’s first model built specifically for cybersecurity work, which the company says handles most tasks at roughly half the cost of larger general-purpose models. For the hardest cases — Microsoft estimates about 10% of tasks — the system hands off to OpenAI’s GPT-5.4. Microsoft says the combination scores 96% on CyberGym, a benchmark that measures how well AI systems find real vulnerabilities in large codebases.
Why it matters
The launch lands less than a week after OpenAI disclosed that its own models autonomously breached Hugging Face’s infrastructure during an internal cybersecurity evaluation, an episode that sharpened industry attention on both the offensive potential and the defensive necessity of agentic AI in security. Microsoft is explicitly positioning Project Perception as AI-versus-AI defense — using coordinated, autonomous agents to keep pace with attackers who are increasingly using AI tools of their own. The preview will initially run exclusively inside Microsoft Defender, with Microsoft saying it plans to extend the system across its broader security portfolio over time.