Microsoft is preparing to launch Project Perception, an AI-powered security platform that scans enterprise codebases for exploitable vulnerabilities — and is built around a deliberate cost-and-access argument against Anthropic’s Claude Mythos Preview, the most capable vulnerability-hunting AI available and one that most organizations on Earth cannot currently use. The exclusive was first reported by The Information on July 17, 2026.

The platform is expected to debut before the end of July. It routes security analysis tasks across AI models from Microsoft, OpenAI, and Anthropic, using a model-selection layer that reserves expensive frontier model calls for the steps where they create real value and assigns cheaper, distilled models to high-volume scan passes. That architecture, according to reporting first published by The Information, is designed to bring the cost of running continuous, enterprise-grade vulnerability discovery well below what Anthropic charges for direct Mythos access.

Project Perception is the work of Hayete Gallot, the executive vice president for security who returned to Microsoft from Google Cloud in February 2026. Since then, she has reorganized the security business around AI products and pulled back investment from older offerings — and Project Perception is the most visible product of that strategic shift.

Mythos Is Powerful, but Most Enterprises Can’t Get Near It

To understand Project Perception’s market logic, start with what Anthropic built and then chose not to release.

Anthropic publicly launched Claude Mythos Preview on April 7, 2026, and simultaneously announced it would not be making the model available to the general public. The reason was stark: Mythos can autonomously discover and weaponize zero-day vulnerabilities, and Anthropic privately warned senior US officials that an uncontrolled release would make large-scale cyberattacks significantly more likely in 2026.

Instead of a public release, Anthropic launched Project Glasswing — a controlled-access consortium of roughly 50 vetted organizations, including AWS, Apple, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Those partners received access to Mythos Preview alongside $100 million in usage credits.

The results validated both the concern and the capability. By May 22, 2026, Glasswing’s roughly 50 partners had collectively used Mythos to identify more than 10,000 high- or critical-severity vulnerabilities across critical software systems worldwide. Anthropic separately used Mythos to scan more than 1,000 open-source projects, flagging 6,202 high- or critical-severity candidates; independent security firms reviewed 1,752 of those findings and confirmed 90.6% to be valid true positives.

But that success is also the program’s structural limitation. The vast majority of enterprise security teams have no Glasswing invitation and no clear path to getting one.

Geography Is the Other Barrier Anthropic Can’t Solve

Cost is not the only obstacle between most enterprises and Mythos-class capability. The second is regulatory.

Fable 5 — the publicly accessible model trained on the same underlying architecture as Mythos but with additional safeguards engaged — was export-restricted by the US government, forcing Anthropic to shut down international access while working with officials to verify it was safe for cross-border use. Microsoft itself restricted Azure customer access to Fable during that period.

Even with Fable 5’s export status since partially restored, governments and financial institutions across Europe have been actively seeking US government assistance to obtain Mythos access — and so far have not received it at scale.

Microsoft is not expected to face the same level of regulatory friction. The company may need to clear a vetting process similar to what OpenAI navigated for GPT-5.6, but Azure’s global data-center footprint — spread across more than 60 regions — positions it structurally to serve allied international markets that Anthropic’s access controls have left unserved.

For European governments and financial institutions that have been courting Washington for months, that is a meaningful distinction.

MDASH: The Engineering Foundation Behind Project Perception

Project Perception does not arrive without a track record to point to.

Microsoft’s Autonomous Code Security team has spent months building MDASH — the Multi-model Agentic Scanning Harness — a system that orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models to discover, validate, and prove exploitable vulnerabilities end-to-end. The team includes members from Team Atlanta, which won the DARPA AI Cyber Challenge by building an autonomous system capable of finding and patching real bugs in complex open-source projects.

The system runs a five-stage pipeline. First, a prepare stage ingests the target codebase, builds language-aware indices, and maps the attack surface by analyzing past commits. Second, scan agents run over candidate code paths, emitting hypotheses and evidence for each potential vulnerability. Third, a separate cohort of debater agents argues for and against each finding’s reachability and exploitability — and the disagreement between models is treated as a signal, not noise. Fourth, a deduplication stage collapses semantically equivalent findings. Fifth, a prove stage constructs and executes triggering inputs to dynamically validate that a candidate vulnerability is real.

This structure makes MDASH different from traditional static analysis, which applies hardcoded rules against known-bad patterns. Static analyzers cannot perform cross-file dataflow analysis, cannot traverse execution paths to confirm exploitability, and cannot chain multi-component vulnerabilities into a proof. MDASH can do all three.

By the time of Microsoft’s Build 2026 conference in early June, MDASH had reached a 96.55% score on the CyberGym benchmark — a publicly validated evaluation framework comprising 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source projects — a gain of roughly 10 percentage points from its 88.45% score at launch in May. For context: traditional commercial static analysis tools typically score in the 30–50% range on benchmark suites that include novel or chained vulnerability classes.

The system’s performance on Microsoft’s own internal code tells a harder story. Running retrospectively against pre-patch snapshots of two heavily audited Windows components, MDASH achieved 96% recall on 28 confirmed Microsoft Security Response Center cases spanning five years in clfs.sys, and 100% recall on 7 confirmed cases in tcpip.sys.

In the May 2026 Patch Tuesday release, MDASH helped researchers identify 16 vulnerabilities across the Windows networking and authentication stack — including four critical remote code execution flaws in components including the Windows TCP/IP stack (tcpip.sys) and the IKEv2 service (ikeext.dll). The system has since entered active use across Windows, Azure, and identity engineering workflows, with findings integrated into Defender, GitHub, and Azure DevOps for prioritization and remediation.

Why the Routing Layer Matters More Than the Model

The architecture argument embedded in Project Perception is the most strategically significant thing about it — and the one most easily overlooked in coverage that focuses on cost.

Taesoo Kim, Microsoft’s VP of Agentic Security and the architect of MDASH, argued in the May 2026 Microsoft Security Blog post announcing the system that the durable competitive advantage in AI vulnerability discovery lies not in any single model but in the agentic harness built around it: “AI vulnerability discovery has crossed from research curiosity into production-grade defense at enterprise scale, and the durable advantage lies in the agentic system around the model rather than any single model itself.”

That argument has a specific structural implication for the Anthropic vs. Microsoft competitive question. Anthropic’s Mythos advantage — the model capability that justified both the public withholding decision and the Glasswing access controls — is explicitly temporary in Kim’s framing. When a better model arrives, MDASH’s targeting, validation, deduplication, and prove stages do not need to be rebuilt. The customer’s accumulated investment in per-project context, scan plugins, and proving agents carries forward.

Microsoft’s platform position — Azure for infrastructure, Defender for enterprise endpoint telemetry, GitHub for source code, Entra ID for identity signals — means it can combine those inputs into an AI security feed in a way that a standalone model provider cannot replicate. That combination, not the model itself, is what Project Perception is ultimately selling.

The counter-argument is equally clear: a product that routes vulnerabilities through multiple AI models — including Anthropic’s — also creates a concentration of security-critical workflow inside a single vendor. Customers considering Project Perception should examine whether the orchestration and integration layer they build around Microsoft’s tooling can be extracted if they decide to change providers later.

What Enterprise Security Teams Should Watch

Whether Project Perception’s access structure will be as open as its cost pitch suggests remains to be confirmed. Project Perception’s availability may itself be restricted at launch, given that tools capable of finding and proving exploitable vulnerabilities before patches are released are categorically different from ordinary security software.

Microsoft has not confirmed pricing, eligibility criteria, supported workloads, or a specific launch date beyond “before end of July.”

What the available evidence does establish is that the broader AI security landscape is changing faster than most enterprise procurement cycles can track. Anthropic’s Glasswing program proved that frontier AI can find vulnerabilities at a scale and cadence no human security team can match. Microsoft’s Project Perception is betting it can bring that capability — or something meaningfully close to it — to a far wider set of organizations, without the export restrictions and access gates that have defined Glasswing’s first three months.

For the majority of enterprise security teams still waiting on a Glasswing invitation, that may be the most important development in AI-powered defense this summer.

Frequently Asked QuestionsHow does Project Perception keep costs lower than Anthropic’s Mythos?

The cost difference comes from architecture, not model substitution. Project Perception uses a model routing layer that assigns each security analysis task to the AI model best suited for it — reserving expensive frontier model capacity for steps like cross-file reasoning and exploit construction, while using faster, cheaper distilled models for high-volume scanning passes. Mythos, accessed directly, applies frontier-model compute to every query regardless of whether that level of capability is required. The routing approach means the average cost per vulnerability report falls substantially even when the underlying models include the same frontier options.

What is MDASH, and is it the same thing as Project Perception?

MDASH stands for Multi-model Agentic Scanning Harness. It is a five-stage pipeline built by Microsoft’s Autonomous Code Security team that orchestrates more than 100 specialized AI agents to discover, debate, validate, and prove exploitable vulnerabilities in enterprise codebases. Microsoft has not confirmed whether Project Perception is a direct commercialization of MDASH, a product built on top of similar architecture, or something else entirely. What is established is that MDASH is already in active use inside Microsoft’s own Windows, Azure, and identity engineering teams, has scored 96.55% on the CyberGym benchmark, and was explicitly referenced alongside Project Perception in Neowin’s July 17 reporting.

Why doesn’t Anthropic’s Mythos export restriction affect Microsoft in the same way?

Anthropic’s Fable 5 model — which shares an underlying architecture with Mythos — was specifically banned from export outside the US by US government order, citing its autonomous vulnerability-exploitation capabilities. Microsoft is a different type of company: it is primarily a platform and services provider rather than an AI model exporter, and its security products are expected to follow a different regulatory review process — similar to the one OpenAI navigated for GPT-5.6 — rather than being classified as restricted dual-use AI exports outright. That said, Microsoft has not received confirmation that Project Perception will face no export review, and early access may still be restricted even if the restrictions take a different form than Anthropic’s.

If a better AI model comes out, does Microsoft’s advantage disappear?

This is the core strategic question, and Microsoft’s own answer is no — deliberately so. The MDASH architecture is explicitly model-agnostic: when a newer model becomes available, switching it into the ensemble requires a configuration change and an A/B test, not a rebuild. Per-project context files, scan plugins, proving agents, and integration with Defender and GitHub all carry forward across model generations. Whether that argument holds in practice — and whether Microsoft’s integration layer creates the kind of proprietary workflow lock-in that makes switching costs higher than advertised — is a question enterprise buyers should probe before committing to the platform.