Sakana AI has released Fugu-Cyber (model ID: fugu-cyber-v1.0), a cybersecurity-focused addition to its Fugu orchestration family. The tool acts as a third endpoint for the Fugu orchestrator, which the company launched a month prior. It is tuned specifically for security reasoning tasks.
The company reports an 86.9% success rate on the CyberGym benchmark and 72.1% on the CTI-REALM benchmark. Sakana describes these figures as comparable to cyber-specialised frontier models such as GPT-5.5-Cyber and Claude Mythos Preview.
What the two benchmarks actually measure
The two evaluations sit at opposite ends of a security workflow:
- CyberGym is a UC Berkeley benchmark of 1,507 real-world vulnerabilities across 188 OSS-Fuzz projects. In its main task, an agent receives a vulnerability description and an unpatched codebase. It must write a proof-of-concept that crashes the pre-patch build but not the post-patch build. That verification step is what makes the benchmark hard to game.
- CTI-REALM is Microsoft’s open-source detection-engineering benchmark. Microsoft curated 37 public threat reports from sources including Datadog Security Labs, Palo Alto Networks, and Splunk. An agent must map MITRE ATT&CK techniques, explore telemetry, iterate on KQL queries, and emit validated Sigma rules. Scoring covers Linux endpoints, Azure Kubernetes Service, and Azure cloud.
Together the pair spans ‘find and prove the bug’ and ‘turn intel into a detection.’ That framing is the most defensible part of Sakana’s announcement.
Where 86.9% sits against the field
Context matters more than the number.
When the CyberGym researchers published their first results, the best agent-model pairing reached roughly 20%. Anthropic reported 83.1% for Claude Mythos Preview under Project Glasswing in April 2026. OpenAI reported 85.6% for its updated GPT-5.5-Cyber, against 81.8% for GPT-5.5. Sakana’s 86.9% is therefore a small step past the reported frontier, not a jump.
CTI-REALM is a different story. Microsoft’s own evaluation put the top three configurations, all Claude, in a band from 0.624 to 0.685. Fugu-Cyber’s 72.1% would sit above that band. One caveat matters. CTI-REALM is scored as a trajectory reward between 0 and 1. It is not a pass/fail rate. Sakana calls it a success rate anyway.
How the orchestration works
Fugu is itself a language model. It is trained to read a query and build an agentic scaffold on the fly. It then delegates sub-tasks to specialist models in a pool.
The approach is documented in the Fugu technical report and two ICLR 2026 papers, TRINITY and the Conductor. TRINITY assigns Thinker, Worker, and Verifier roles across multiple LLMs. The Conductor learns natural-language coordination strategies through reinforcement learning.
For security work, Sakana research team argues the verifier role is the point. A candidate vulnerability surfaced by one agent gets validated by security-specialised sub-agents before any patch is proposed. Routing remains proprietary, so you cannot see which model handled which step.
Access, policy, and price
Fugu-Cyber is gated on four dimensions.
Access requires an application form stating the intended use case and verified contact details. Sakana team reviews each one manually. The model ships under an updated Acceptable Usage Policy that prohibits offensive misuse. Billing is restricted to the Token Plan. The $20, $100, and $200 subscription tiers cover Fugu and Fugu-Ultra only. And the Fugu API is not offered in the EU or EEA while Sakana works toward GDPR compliance.
Pricing is fixed at $6 per million input tokens, $36 output, and $0.60 cached input. All three rates double above a 272K-token context. Every line is exactly 1.2× the Fugu-Ultra rate, a flat 20% premium for the cyber endpoint. Long codebase runs cross 272K easily, so the doubled tier is not an edge case.
What it means for security teams
The release changes the workflow for security engineers by embedding validation directly into the orchestration layer. Instead of running a single model to generate a fix, the system routes the task to a verifier first. This ensures a candidate vulnerability is validated by security-specialised sub-agents before any patch is proposed. The proprietary routing means users cannot inspect which specific model handled which step, but the structure enforces a check before a change is applied.
