Sakana AI’s Fugu-Cyber Claims Top CyberGym Score at 86.9%

Sakana AI launched Fugu-Cyber (model ID: fugu-cyber-v1.0) on July 21, 2026, adding a cybersecurity-focused endpoint to its Fugu orchestration platform. The company self-reports 86.9% on CyberGym and 72.1% on CTI-REALM, placing it narrowly ahead of GPT-5.5-Cyber (85.6%) and Claude Mythos Preview (83.1%) on the former benchmark. Access is gated behind a manual application, a defensive-use policy, and a Token Plan billing requirement. The EU and EEA are excluded for now while Sakana works toward GDPR compliance.

What happened

Detail	Fact
Model ID	fugu-cyber-v1.0
Launch date	July 21, 2026
CyberGym score	86.9%
CTI-REALM score	72.1% (trajectory reward, 0-1 scale)
Input token price	$6 per million (doubles above 272K context)
Output token price	$36 per million (doubles above 272K context)
Cached input price	$0.60 per million
Premium vs Fugu-Ultra	Flat 20% across all three rates
Availability	Token Plan only, no EU/EEA, gated access

Fugu-Cyber is not a new frontier model trained from scratch. It is an additional endpoint on Sakana’s Fugu orchestrator, which the company launched roughly a month before this release. The orchestrator is itself a language model trained to read a query, build an agentic scaffold on the fly, and delegate sub-tasks to a pool of specialist models.

The architecture draws on two ICLR 2026 papers. TRINITY assigns Thinker, Worker, and Verifier roles across multiple models. The Conductor learns coordination strategies through reinforcement learning. For security work, Sakana argues the Verifier role is the key piece: a candidate vulnerability found by one agent gets checked by security-specialized sub-agents before any patch is proposed. The routing between models is proprietary and not visible to users.

What the two benchmarks actually measure

CyberGym is a UC Berkeley benchmark built around 1,507 real-world vulnerabilities drawn from 188 OSS-Fuzz projects. An agent receives a vulnerability description and an unpatched codebase. It must write a proof-of-concept exploit that crashes the pre-patch build but leaves the post-patch build running. That two-sided verification step makes the benchmark difficult to game. When CyberGym researchers published their first results, the best agent-model combination reached roughly 20%.

CTI-REALM is Microsoft’s open-source detection-engineering benchmark. Microsoft curated 37 public threat reports from Datadog Security Labs, Palo Alto Networks, Splunk, and others. An agent must map MITRE ATT&CK techniques, explore telemetry, iterate on KQL queries, and produce validated Sigma rules (detection logic written in a vendor-neutral format). Scoring covers Linux endpoints, Azure Kubernetes Service, and Azure cloud. Critically, CTI-REALM produces a trajectory reward between 0 and 1, not a pass/fail rate. Sakana describes the 72.1% figure as a “success rate,” which overstates the precision of the metric.

How does Fugu-Cyber compare to frontier models?

Model	CyberGym score	CTI-REALM score
Fugu-Cyber v1.0	86.9%	72.1%
GPT-5.5-Cyber	85.6%	Not reported
Claude Mythos Preview	83.1%	0.624-0.685 (top 3 configs)
GPT-5.5	81.8%	Not reported

On CyberGym, Fugu-Cyber is a small step ahead of the reported frontier, not a leap. On CTI-REALM, if Sakana’s number is accurate, it sits above the band Microsoft reported for its own top three Claude configurations (0.624 to 0.685). Both sets of numbers are self-reported and have not been independently replicated.

Access and pricing details

Getting access requires completing an application form with your intended use case and verified contact details. Sakana reviews each application manually. The model ships under an updated Acceptable Usage Policy that prohibits offensive use. Billing is restricted to the Token Plan. The existing $20, $100, and $200 subscription tiers cover only Fugu and Fugu-Ultra. No API weights are released.

Pricing sits at a flat 20% premium above Fugu-Ultra rates across every tier. Long codebase analysis runs well past the 272K-token context threshold routinely, so the doubled pricing above that limit is not a rare edge case for real security work.

Why it matters

Security is one of the clearest near-term use cases for AI agents. The two benchmarks Sakana chose are reasonably well-designed: CyberGym’s two-sided verification resists simple prompt tricks, and CTI-REALM covers a realistic detection-engineering workflow. If the scores hold under independent testing, that is meaningful progress toward automating parts of vulnerability research and threat detection.

The orchestration approach is also worth watching separately from the scores. Routing sub-tasks to specialist models and using a dedicated verifier agent is a pattern appearing across several serious AI labs right now. It is a more honest framing than “one model does everything.” Our coverage of Microsoft MAI models touched on similar multi-model strategies improving cost and task performance.

Our take

The benchmarks are better than most. CyberGym’s two-sided exploit test and CTI-REALM’s detection workflow are harder to inflate than typical Q&A evals. That said, every number here is self-reported, and Sakana’s framing of a trajectory reward as a “success rate” is a small but real credibility dent.

The pricing structure deserves scrutiny. At $36 per million output tokens, a serious codebase audit that crosses the 272K-token threshold jumps to $72 per million output. That adds up fast on large projects. Compare that to general-purpose frontier models before deciding if the cyber specialization justifies the premium.

If you are evaluating AI for security workflows as part of a broader AI integration project, the gating, EU exclusion, and proprietary routing all matter as much as the benchmark numbers. Sakana’s own position is that the API plus human expertise beats the API alone. That is correct, and it is also a convenient hedge when the numbers have not been replicated.

What to do about it

1. Check whether you are in an eligible region. EU and EEA access is not available yet.
2. Apply through Sakana’s form with a specific, documented use case. Manual review means vague applications are likely to be rejected.
3. Estimate your token usage against real codebases before committing to the Token Plan. Factor in the doubled rates above 272K tokens.
4. Watch for independent benchmark replications before treating the 86.9% and 72.1% figures as settled facts.

Treat these numbers as a credible signal worth watching, not a confirmed capability to deploy immediately.

Source: Marktechpost