Sakana AI's Fugu-Cyber Matches GPT-5.5 on the Hardest Security Benchmarks

Fugu-Cyber is Sakana AI's cybersecurity-specialized variant of its Fugu orchestration model. It scores 86.9% on CyberGym and 72.1% on CTI-REALM, two of the hardest real-world security benchmarks available, putting it alongside dedicated cyber models like GPT-5.5-Cyber and Mythos Preview. The benchmark numbers are strong, but the more interesting part of the release is the argument Sakana makes about what those numbers actually mean in production.

What Fugu Does, and Why Cyber Is Different

Fugu is a language model trained to coordinate other models: when to delegate, how agents should communicate, and how to combine their outputs into a single reliable answer. The architecture comes from Sakana's ICLR 2026 research, specifically the TRINITY and Conductor papers. Where a typical LangChain setup requires you to wire together a graph and decide which model calls which, Fugu learns that coordination directly.

Two research threads underpin it:

• TRINITY is a roughly 0.6B-parameter coordinator, evolved with CMA-ES, that assigns Thinker, Worker, and Verifier roles across a pool of larger worker models, adapting dynamically across coding, math, and reasoning tasks.
• Conductor is trained with reinforcement learning to discover natural-language coordination strategies, effectively teaching a diverse model pool how to communicate so the group outperforms any individual member.

Fugu-Cyber applies that same architecture to security workflows. You send a request to one endpoint; the system routes it across a pool of specialized agents and returns a single answer, without requiring you to manage the orchestration or accept single-vendor dependency.

The Benchmarks: What They Actually Test

Both benchmarks are meaningfully harder than most cyber evals, and worth understanding in detail.

• CyberGym covers 1,507 real-world vulnerabilities across 188 software projects. Agents receive a vulnerability's text description and the corresponding codebase, then must generate a proof-of-concept test that reproduces it. Fugu-Cyber scores 86.9%.
• CTI-REALM is Microsoft's open-source benchmark that places agents in a realistic, tool-rich environment and asks them to complete a five-stage detection engineering workflow: CTI Report Analysis, MITRE Technique Mapping, Data Source Discovery, KQL Development, and Detection Rule Generation. Fugu-Cyber scores 72.1%.

Most existing cybersecurity benchmarks test parametric knowledge or isolated subtasks like rule synthesis, TTP classification, or threat actor attribution. Neither CyberGym nor CTI-REALM does that. Both test the end-to-end analytical pipeline that security teams run daily, which is what makes them a more credible signal.

The Reality Check That Comes With the Numbers

Sakana ships a strong benchmark result and immediately argues that benchmark results alone are insufficient. The company cites a Nikkei Digital Governance report on enterprise AI deployments in Japan, noting that large organizations, including major financial institutions, struggle to operationalize these tools without specialized internal talent and deep integration into proprietary source code. A frontier model with state-of-the-art cyber capabilities cannot easily uncover or patch real-world vulnerabilities without that foundation.

The core problem is false positives. A raw model deployed in isolation will generate noise and miss the nuances of a live production environment. Sakana's proposed solution is a layered system:

• Fugu-Cyber as the core reasoning engine
• Sub-agents specialized for cybersecurity verification
• Human-in-the-loop confirmation before any patch is proposed
• Deep integration with proprietary source code and internal tooling

Sakana's Applied Enterprise team is actively building these harnesses for major Japanese institutions, using Fugu-Cyber as the underlying engine.

Access and Pricing

Fugu-Cyber is available as an API endpoint at sakana.ai/fugu. It uses an OpenAI-compatible API, so teams already calling GPT or Claude via API will find the integration change minimal.

Pricing is pay-as-you-go only, via the Token Plan. Rates for fugu-cyber-v1.0:

• Input: $6 per million tokens ($12 above 272K context)
• Output: $36 per million tokens ($54 above 272K context)
• Cached input: $0.60 per million tokens ($1.20 above 272K context)

Access requires an application: submit a request form with your intended use case and verified contact information, and the team manually reviews each submission before granting access. An updated Acceptable Usage Policy prohibits offensive misuse. EU and EEA teams cannot access it yet.

Where It Performs Well, and Where It Doesn't

On the defensive side, the use cases are concrete. One security engineer in Sakana's user testimonials ran a full security assessment from a single scoped instruction, covering recon, XSS and SQLi checks, auth review, and a final report with evidence and retest steps, while staying inside scope and avoiding destructive actions.

The practical sweet spots for Fugu-Cyber are:

• Vulnerability analysis across large codebases
• Translating threat intelligence reports into detection rules (KQL, Sigma)
• Security assessment automation with human review gates
• Threat investigation workflows where depth and precision matter

Where it falls short is where every raw model falls short in security: without verification sub-agents and human review, a potential vulnerability finding must still be validated against a real environment before a patch is proposed. Skip the harness and you get false positives and noise.

Orchestration as the Actual Product

Fugu-Cyber is the sharpest expression yet of a thesis Sakana has been building toward: the next performance gains come from coordinating models rather than scaling a single one. TRINITY and the Conductor approach the same idea from different angles. A system can learn to assemble, route, and coordinate expert agents per task, rather than relying on a human to hand-design the workflow. That is the difference between an orchestration framework you configure and an orchestration model you call.

For cybersecurity specifically, this architecture fits the domain well. The tasks are inherently multi-step and require different kinds of reasoning at each stage: code analysis, threat intel parsing, query writing, and rule validation are distinct skills. Routing them to specialized agents rather than asking one model to do all of them is a reasonable structural bet.

Sakana also frames Fugu explicitly as a hedge against single-vendor dependency. If one provider restricts access, Fugu routes around the disruption. The team cites recent export controls on Anthropic's Fable and Mythos models as part of the motivation. The benchmarks are vendor-reported and the competitive picture is not a clean sweep, but the direction is clear: orchestration is no longer a side technique, and Fugu-Cyber is worth benchmarking against your own workload.

For security teams evaluating AI tooling: Fugu-Cyber delivers frontier-level reasoning on hard defensive tasks, wrapped in an architecture designed to be composed rather than deployed raw. Benchmark parity with GPT-5.5-Cyber is real. Whether it translates to your environment depends on the harness you build around it, and Sakana is betting that building that harness is the actual product.