Sakana AI launched Fugu-Cyber on July 21, 2026 — a third endpoint on its Fugu multi-agent orchestrator tuned for security reasoning. Sakana reports 86.9% on CyberGym (above GPT-5.5-Cyber's 85.6% and Claude Mythos Preview's 83.1%) and 72.1% on CTI-REALM. Pricing is $6 / $36 / $0.60 per million tokens with a 20% premium over Fugu-Ultra. Access is gated: application form, manual review, defensive AUP, no EU/EEA, no weights. The point is not the benchmark. The point is that this is the first credible answer to the question 'can a hosted frontier API ever be safe enough for a SOC to actually use?' Here is the architecture, the cost model, the comparison to Mythos / GPT-5.5-Cyber / a self-hosted stack, and the playbook for what to build on top of it.

Sakana AI Just Quietly Solved the Cyber-Bot Problem Nobody Was Building For. Fugu-Cyber Hits 86.9% on CyberGym and 72.1% on CTI-REALM by Routing a Pool of Frontier Models Behind One Endpoint.

Hey guys, Mr. Technology here.

It is Tuesday, July 28, 2026, and the most important model release of the last seven days is not from OpenAI, Anthropic, Google, or xAI. It is from Sakana AI in Tokyo. On Monday, July 21, Sakana shipped Fugu-Cyber — a security-specialized endpoint on its existing Fugu multi-agent orchestrator. The benchmarks are the headline. The architecture is the story. The access gating is the part every CISO should actually care about.

What You Need to Know

- What: Fugu-Cyber (fugu-cyber-v1.0), a third endpoint on Sakana's Fugu orchestrator tuned for cybersecurity reasoning. - When: July 21, 2026. - Scores: 86.9% on CyberGym and 72.1% on CTI-REALM. - Comparison: 86.9% edges past GPT-5.5-Cyber's reported 85.6% and Claude Mythos Preview's 83.1% on CyberGym; 72.1% sits above Microsoft's own top-three band of 0.624 to 0.685 on CTI-REALM. - Price: $6 / $36 / $0.60 per million input / output / cached tokens — 1.2× Fugu-Ultra, doubles above 272K context. - Access: Application form, manual review, defensive AUP, Token Plan only, no EU/EEA, no weights, no self-hosting.

Why It Matters

The cyber-benchmarks race is compressed. Three frontier-class systems (Mythos Preview, GPT-5.5-Cyber, Fugu-Cyber) sit within ~4 points on CyberGym. Picking "the best cyber model" is now a 2–4% decision.
The access model is the product. Manual review, defensive-only AUP, no EU/EEA, no weights, no self-hosting. This is the first frontier-class cyber endpoint that admits an unrestricted API is not an enterprise security program. The answer is gated capability inside a verification workflow, not a bigger model.
It is the test case for whether "gated capability + verification harness + human-in-the-loop" is a real moat. If Sakana's enterprise rollouts work, every other lab copies the playbook. If they do not, the cyber-API market stays a benchmark leaderboard forever.

The Benchmarks, And Why The Caveats Matter

CyberGym is a UC Berkeley benchmark of 1,507 real-world vulnerabilities across 188 OSS-Fuzz projects. The agent gets a vulnerability description and an unpatched codebase, and must write a proof-of-concept that crashes the pre-patch build but not the post-patch build. That verification step is what makes it hard to game. When the researchers first published, the best pairing reached about 20%. Sakana's 86.9% is a small step past the current frontier (GPT-5.5-Cyber at 85.6%, Mythos Preview at 83.1%), not a four-times jump. The leaderboard is compressed.

CTI-REALM is Microsoft's open-source detection-engineering benchmark, built from 37 public threat reports. The agent must map MITRE ATT&CK techniques, iterate on KQL queries, and emit validated Sigma rules across Linux endpoints, AKS, and Azure cloud. Microsoft's own evaluation put the top three configurations — all Claude — in a band from 0.624 to 0.685. Sakana's 72.1% sits above that band. One caveat: CTI-REALM is a trajectory reward between 0 and 1, not a pass/fail rate. Sakana calls it a "success rate." Be precise.

Both numbers are self-reported. The evaluation harness, model configs, and prompt templates are unpublished. Independent reproduction is not yet available — Marktechpost and explainx.ai both flagged the gap within days. Treat 86.9 / 72.1 as directional, not definitive.

The Architecture Is The Actual Story

Fugu-Cyber is not a base model. It is a third endpoint on the existing Fugu orchestrator. Fugu itself is a small language model trained to read a query, build an agentic scaffold on the fly, and delegate sub-tasks to specialist models in a swappable pool. Two ICLR 2026 papers underpin the design:

TRINITY evolves a compact coordinator that delegates Thinker / Worker / Verifier roles to multiple LLMs across turns.
The Conductor uses reinforcement learning to generate natural-language agent-to-agent communication structures and focused prompts.

The pool behind Fugu (documented in the Fugu technical report, arXiv:2606.21228) includes Claude Opus 4.8, Gemini 3.1 Pro, GPT-5.5, undisclosed open models, and the orchestrator itself as a recursive worker. Fugu-Ultra can construct workflows of up to five steps.

For Fugu-Cyber, the Verifier role is the point. A candidate vulnerability surfaced by one agent gets validated by security-specialized sub-agents before any patch is proposed. Routing is proprietary — Sakana does not expose which model handled which step. For SOC teams with strict audit requirements, that opacity is a non-trivial trade-off.

Model	Optimization	Best fit	Access
Fugu	Performance / latency balance	Coding, review, chat	Subscription or PAYG
Fugu-Ultra	Max quality through deeper orchestration	Hard engineering, research	Subscription or PAYG
Fugu-Cyber	Security reasoning + verification	Vuln analysis, threat intel, detections	Approved Token Plan

All three use one OpenAI-compatible API. Switching between them requires no code change.

Pricing And Access

Pricing is fixed at $6 / $36 / $0.60 per million input / output / cached tokens. Every line is exactly 1.2× the Fugu-Ultra rate — a flat 20% premium. Clean pricing: same orchestration, same pool, security-trained routing layer on top.

All three rates double above 272K-token context. A single CyberGym-style task on a large C/C++ codebase can easily push past 272K. A CTI-REALM task with 30 pages of threat report can too. Effective per-token rate at the high end is $12 / $72 / $1.20.

Access is gated on four dimensions:

1. Application form with stated use case and verified contact details. Manual review. 2. Defensive-use AUP that prohibits offensive misuse. 3. Token Plan only. The $20 / $100 / $200 subscription tiers cover Fugu and Fugu-Ultra only. 4. Not available in the EU or EEA while Sakana works toward GDPR compliance. UK and Switzerland also excluded.

There are no weights, no self-hosting, no on-prem deployment. Hosted API, full stop.

Where It Does Not Win

Not self-hosted. If you need weights inside your VPC for data-residency, run a local model fine-tuned on your own corpus.
Not benchmark-independent. 86.9% and 72.1% are self-reported. Configs, prompts, and tool definitions are unpublished. Marktechpost, explainx.ai, and Tech Times all flagged the gap.
Not a cyber-offense endpoint. The AUP prohibits offensive misuse. Red teams doing pen testing are not the target — Mythos / Project Glasswing or GPT-5.5-Cyber are the relevant options. Fugu-Cyber is built for blue-team workflows.
Not EU-compliant yet. GDPR, EU AI Act, Data Act all need more work. The clock is not on your side if you are EU-headquartered.
Routing is opaque. For SOC teams that need a full audit trail of which vendor's model produced which finding, this is a meaningful gap.

The Real Take

The reason Fugu-Cyber matters is not the benchmark. It is the product shape.

Frontier cyber models — Claude Mythos Preview, GPT-5.5-Cyber, Fable 5 — are within a few percentage points of each other on CyberGym, CTI-REALM, and the red-team evals. Picking "the best cyber model" is now a 2–4% decision. Not a defensible moat. What is defensible is the gated-capability-inside-a-verification-workflow pattern Sakana is shipping.

If you are a CISO evaluating a security-AI vendor in the second half of 2026, the question is no longer "which model has the highest CyberGym number?" It is: who has a real verification harness, who has a defensible AUP, who has the data-residency story, who has the SOC integration story, and who can tell me which model handled which step? Sakana has the first three, not the fourth. Anthropic Mythos has the first and fourth, not the second. OpenAI GPT-5.5-Cyber has the first and second, not the third. Nobody has all four.

For builders: the orchestrator + verification-harness pattern is now a product category. If you are building security tooling on top of hosted APIs in 2026, stop picking one model and one prompt. Build the harness. Route across a pool. Verify before you ship. Sakana validated the pattern is good enough to charge $6 / $36 for. The question is whether the rest of the market catches up, or whether Sakana gets to keep the entire $200M/year cyber-API market to itself for 18 months.

For everyone else: the playbook generalizes. Gated capability + verification harness + human-in-the-loop is the answer to "how do we ship a frontier model for a sensitive workflow without breaking the workflow?" That question is coming to your industry within 12 months.

Monday morning, file the Fugu-Cyber access application. The Token Plan rate is $6 / $36. The doubled tier is $12 / $72. The architecture is two ICLR 2026 papers and a swappable model pool. The product shape is gated capability inside a verification workflow. The market just got a new category.

Build accordingly.

— Mr. Technology

Quick Summary

What: Fugu-Cyber (fugu-cyber-v1.0), third endpoint on Sakana AI's Fugu multi-agent orchestrator
When: July 21, 2026
Scores: 86.9% CyberGym (above GPT-5.5-Cyber's 85.6% and Mythos Preview's 83.1%), 72.1% CTI-REALM (above Microsoft's own top-three Claude band)
Price: $6 / $36 / $0.60 per million input / output / cached input tokens (1.2× Fugu-Ultra), doubles above 272K context
Access: Application form, manual review, defensive AUP, Token Plan only, no EU/EEA, no weights, no self-hosting
Architecture: Orchestrator + swappable model pool (Claude Opus 4.8, Gemini 3.1 Pro, GPT-5.5, undisclosed open models, itself); Verifier role is the security-critical piece
Research lineage: TRINITY (ICLR 2026), The Conductor (ICLR 2026), Fugu technical report arXiv:2606.21228
Where it doesn't win: Self-hosted is not an option; benchmarks are self-reported and un-replicated; not for red-team/offensive use; not yet EU-compliant; routing is opaque
Why it matters: First credible "gated capability + verification harness + human-in-the-loop" product for a hosted frontier cyber API. Defines a new product category.

Sources

Introducing Fugu-Cyber — Sakana AI — primary launch post with benchmark figures, comparison to GPT-5.5-Cyber and Mythos Preview, AUP, and access gating.
Sakana Fugu — Multi-Agent System as a Model — product page with the three-model lineup (Fugu, Fugu-Ultra, Fugu-Cyber) and pricing for the Fugu endpoint.
Sakana Fugu technical report, arXiv:2606.21228 — architecture, model pool composition, adaptive memory, and multi-step workflow construction.
TRINITY: An Evolved LLM Coordinator, arXiv:2512.04695 — ICLR 2026 paper on Thinker/Worker/Verifier role assignment.
Learning to Orchestrate Agents in Natural Language with the Conductor, arXiv:2512.04388 — ICLR 2026 paper on RL-trained coordination strategies.
Sakana AI Releases Fugu-Cyber: An Orchestration Model Reporting 86.9% on CyberGym and 72.1% on CTI-REALM — MarkTechPost, July 25, 2026 — independent coverage flagging self-reported benchmark methodology, context-tier pricing, and access gating.
Fugu-Cyber: Sakana AI Orchestrates Frontier Models for Cyber Defense — explainx.ai, July 21, 2026 — independent coverage with TL;DR table, benchmark interpretation, and Sakana's Applied Enterprise team framing.
Sakana AI Fugu-Cyber Claims 86.9% Vulnerability Score — Tech Times, July 22, 2026 — same-day coverage emphasizing "benchmark methodology not disclosed."
CyberGym benchmark, UC Berkeley, arXiv:2506.02548 — original CyberGym paper, 1,507 real-world vulnerabilities across 188 OSS-Fuzz projects.
CTI-REALM benchmark, Microsoft, arXiv:2603.13517 — Microsoft's open-source detection-engineering benchmark, 37 public threat reports, Sigma rule scoring.
Claude Mythos Preview — Project Glasswing, Anthropic, April 2026 — Anthropic's cyber-focused frontier model under restricted access; the 83.1% CyberGym reference point.
GPT-5.5-Cyber trusted-access program — OpenAI — OpenAI's cyber-focused frontier model; the 85.6% CyberGym reference point.
LLM Release Timeline — LLM Gateway — confirms Fugu-Cyber as the most recent non-frontier cyber release and lists parallel July 2026 launches (Claude Opus 5, Grok STT 1.0, Gemini 3.6 Flash).
Mr. Technology — Anthropic Just Finished the Claude 5 Lineup — the Claude 5 lineup context for Mythos Preview and the Opus pricing reference points used in the comparison table.