Sakana AI Releases Fugu-Cyber: An Orchestration Model Reporting 86.9% on CyberGym and 72.1% on CTI-REALM

What Fugu-Cyber Is and Why It Matters

Sakana AI has added a cybersecurity-specialized endpoint to its Fugu orchestration family: Fugu-Cyber (model ID fugu-cyber-v1.0). Rather than a standalone frontier model, Fugu-Cyber is a third endpoint on the Fugu orchestrator, tuned specifically for security reasoning. The underlying orchestrator launched a month earlier, and this new security variant is the first domain-specific addition.

For developers building AI-assisted security tooling, the announcement signals a shift. Instead of relying on a single monolithic model for vulnerability research or detection engineering, Fugu-Cyber leverages an orchestration layer that delegates sub-tasks to specialist models in a pool. The reported results — 86.9% on CyberGym and 72.1% on CTI-REALM — are notable, but the architecture behind them is arguably more consequential. Sakana describes these scores as comparable to cyber-focused frontier models such as GPT-5.5-Cyber and Claude Mythos Preview, but the orchestration approach introduces a different set of trade-offs for security teams evaluating their toolchain.

Benchmark Breakdown: CyberGym and CTI-REALM

The two benchmarks Sakana cites sit at opposite ends of a realistic security workflow. CyberGym is a UC Berkeley benchmark consisting of 1,507 real-world vulnerabilities across 188 OSS-Fuzz projects. In its main task, an agent receives a vulnerability description and an unpatched codebase, then must write a proof-of-concept that crashes the pre-patch build but not the post-patch build. This verification step — validating that the exploit works only on the vulnerable version — makes the benchmark hard to game. It directly tests whether an agent can both find and prove a bug.

CTI-REALM is Microsoft’s open-source detection-engineering benchmark. Microsoft curated 37 public threat reports from sources including Datadog Security Labs, Palo Alto Networks, and Splunk. An agent must map MITRE ATT&CK techniques, explore telemetry, iterate on KQL queries, and emit validated Sigma rules. Scoring covers Linux endpoints, Azure Kubernetes Service, and Azure cloud. Where CyberGym tests offensive capability, CTI-REALM tests defensive: turning threat intelligence into a reliable detection.

Context matters more than the raw numbers. When CyberGym researchers first published results, the best agent-model pairing reached roughly 20%. Anthropic reported 83.1% for Claude Mythos Preview under Project Glasswing in April 2026. OpenAI reported 85.6% for its updated GPT-5.5-Cyber, against 81.8% for GPT-5.5. Sakana’s 86.9% is therefore a small step past the reported frontier, not a dramatic leap. For developers, this means Fugu-Cyber is competitive at the very top of the current benchmark leaderboard, but margins are thin.

CTI-REALM tells a different story. Microsoft’s own evaluation put the top three configurations, all Claude, in a band from 0.624 to 0.685. Fugu-Cyber’s 72.1% sits clearly above that band. One important caveat: CTI-REALM is scored as a trajectory reward between 0 and 1, not a pass/fail rate. Sakana calls it a success rate anyway. Practitioners should treat the CTI-REALM number as a strong signal but verify reproducibility on their own datasets.

How Fugu’s Orchestration Architecture Works for Security

Fugu is itself a language model. It is trained to read a query and build an agentic scaffold on the fly, then delegate sub-tasks to specialist models in a pool. The approach is documented in the Fugu technical report and two ICLR 2026 papers: TRINITY and the Conductor. TRINITY assigns Thinker, Worker, and Verifier roles across multiple LLMs. The Conductor learns natural-language coordination strategies through reinforcement learning.

For security work, Sakana’s research team argues the verifier role is the point. A candidate vulnerability surfaced by one agent gets validated by security-specialized sub-agents before any patch is proposed. This mirrors how real security teams operate — triage, verify, then act. Routing remains proprietary, so you cannot see which model handled which step. That lack of transparency is a trade-off: the orchestration layer may produce better results, but debugging a failure chain is harder when you cannot inspect intermediate decisions.

From a developer perspective, Fugu-Cyber fits into the broader landscape of AI coding agents and security automation. If you are already using agents for secure code review or vulnerability detection, this model offers a purpose-built orchestration rather than a general-purpose model fine-tuned on security datasets. For teams building more complex security pipelines, the verifier loop could reduce false positives in automated patch generation. That said, the performance difference over existing top-tier models like Claude Mythos Preview is marginal on CyberGym — a few percentage points — so the value proposition hinges more on the orchestration architecture than raw benchmark score.

Access, Pricing, and the Developer Experience

Fugu-Cyber is gated on four dimensions. Access requires an application form stating the intended use case and verified contact details; Sakana reviews each one manually. The model ships under an updated Acceptable Usage Policy that prohibits offensive misuse. Billing is restricted to the Token Plan — $20, $100, and $200 subscription tiers that cover Fugu and Fugu-Ultra only. And the Fugu API is not offered in the EU or EEA while Sakana works toward GDPR compliance.

Pricing is fixed at $6 per million input tokens, $36 per million output tokens, and $0.60 per million cached input tokens. All three rates double above a 272K-token context — a critical detail for security use cases. Long codebase runs, threat report ingestion, or multi-file vulnerability analysis easily cross 272K tokens, so the effective cost for non-trivial tasks can be 2× the base rate. Every line is exactly 1.2× the Fugu-Ultra rate, a flat 20% premium for the cyber endpoint.

For developers evaluating cost, consider that existing AI coding agents often bundle token costs differently. A comparison of best AI coding agents in 2026 shows a wide spread in pricing models; Fugu-Cyber’s per-token rates are premium but not out of line for specialized security reasoning. However, the manual approval gate and EU exclusion are significant friction points for international teams or those needing rapid provisioning. Sakana’s cautious rollout suggests they are prioritizing responsible use over market share — a defensible choice for offensive security tooling, but one that limits immediate adoption.

What This Means for AI-Assisted Security Tooling

Fugu-Cyber is not a general-purpose coding agent. It is a focused endpoint for vulnerability discovery and detection engineering. For developers building automated security pipelines, the key takeaway is that orchestration-based models can now match or slightly exceed monolithic frontier models on curated benchmarks. The verifier role is particularly interesting: it addresses a known weakness in agentic security tools, which tend to generate plausible but unverified patches.

Still, the practical impact depends on your workflow. If you rely on agents for code review, you might find a more direct comparison between Fugu-Cyber and other coding assistants useful. For example, Cursor vs Claude Code compares how two popular development agents handle security-sensitive refactoring — a different use case from Fugu-Cyber’s exploit validation but relevant to the broader tooling landscape. Fugu-Cyber’s strength lies in discrete security tasks, not general-purpose IDE integration.

The flat 20% premium over Fugu-Ultra is reasonable if the orchestration truly improves detection accuracy, but the lack of transparency into routing decisions may trouble teams that need explainability for compliance. Similarly, the 272K token doubling threshold means that deeply nested security analyses will cost more than the headline rates suggest. Developers should budget accordingly.

Overall, Fugu-Cyber represents a maturing of domain-specific orchestration. It is not a breakthrough — the CyberGym improvement is incremental, and the CTI-REALM score, while strong, comes with a scoring caveat. But the architecture points to where AI-assisted security is headed: not bigger models, but smarter coordination between specialist components. For teams willing to navigate the access gate and accept the orchestration black box, Fugu-Cyber is currently among the top options for automated vulnerability validation and detection engineering.

Source: MarkTechPost. Details as reported; verify specifics at the source.