OrcaRouter Releases OrcaCyber Zero 1.5 Cybersecurity Model With 1M Context

OrcaRouter has pushed out OrcaCyber Zero 1.5, the latest version of its security-focused model and the follow-up to OrcaCyber Zero 1.0, which shipped on September 17, 2026. The pitch is straightforward: this one is trained for authorized vulnerability research, including reproduction, exploit development and penetration testing.

The headline feature is the size of the window. OrcaCyber Zero 1.5 ships with 1M-token context, plus native function calling and structured outputs. Orca says that makes it better suited to long, messy security work across large codebases, where the model has to track evidence, test ideas and keep going without losing the thread.

The benchmark claims are strong, at least on paper. Orca reports 100% on Cybench, 95.8% on CVE-Bench, 93.9% on HumanEval+ and 76.5% on SWE-bench Pro V2. The company says the Cybench score covers 39 tasks under unrestricted agent execution, while the CVE-Bench result comes from a 24-task evaluable subset. It also says the SWE-bench Pro V2 number is not directly comparable with standard SWE-bench Pro results.

Access is tightly controlled. Developers use an OpenAI-compatible API through OrcaRouter, but only through the Security Research tier. Orca says that tier is for trusted security researchers, red teams and authorized testing, with an engagement, a passkey and accepted terms required. Pricing is set at $3.00 per 1M input tokens and $7.50 per 1M output tokens, with cache reads at $0.75 per 1M tokens.

Orca also says the model is built for autonomous agents and large-scale security reasoning, with a focus on finding flaws such as RCE, sandbox escapes, auth bypasses, privilege escalation and attack chains. The company’s own numbers are doing most of the talking here, though, and the fine print matters: there’s no independent replication in the release, no disclosed parameter count and no weights for anyone to poke at locally.