A security model that thinks in attack paths
On October 12, 2026, Continuum AI introduced OrcaCyber Zero 1.5, the newest version of its cybersecurity reasoning model. The release was announced through PR Newswire, with third-party coverage noting the model’s page went live on OrcaRouter on October 10. The predecessor, OrcaCyber Zero 1.0, had shipped barely a month earlier, on September 17.
That pace says a lot. While the frontier labs spent the past month racing on price — Anthropic’s Claude Haiku 5.5, OpenAI’s GPT-6 family — smaller outfits have been building models that are not chatbots at all. OrcaCyber Zero 1.5 does not write poetry or summarize inboxes. It reads codebases, hunts for vulnerabilities, traces multi-stage attack paths, and then tries to prove a flaw is actually exploitable.
What the model actually does
Continuum AI describes Zero 1.5 as built for autonomous security investigations across large codebases and interconnected systems. Three technical details matter most: a 1-million-token context window that holds whole repository structures, long security logs, and investigation histories without splitting evidence across sessions; native tool calling, so the model can drive the tooling a human analyst would use; and extended reasoning — the multi-step chains of thought that let it work through an attack path. It supports structured outputs, text in and text out, with up to 128K output tokens per run, served through an OpenAI-compatible API.
The pitch is “from alerts to actionable cyber defense.” Security teams drown in alerts; the promise is a model that prioritizes reproducible evidence instead of alert volume — vulnerability discovery, exploit validation, root-cause analysis, and tested remediation in one loop. The goal is to help analysts separate theoretical weaknesses from validated risk, and to hand them fixes backed by reproducible tests.
The benchmark claims — and the caveats
Continuum AI reports three headline numbers from its own evaluations: 95.8% on CVE-Bench (23 of 24 evaluable tasks), 100% on Cybench (39 of 39 challenges, unrestricted), and 93.9% on HumanEval+. The predecessor Zero 1.0 powered an autonomous harness that scored over 98% pass@1 on CyberGym, which the company says ranked it among the top three systems globally.
MarkTechPost, in its coverage, added the caveat that every one of these figures comes from the vendor’s own announcement, with no published technical report and no independent replication yet. That deserves saying plainly. Cybench’s unrestricted track is a genuinely hard test — 39 challenges is a clean sweep if it holds — but until independent evaluators run the model against public harnesses, the numbers are marketing-adjacent. Interesting, plausible, unverified.
Six demonstrations of what it can do
More vivid than the benchmarks are the six controlled demonstrations — each one a miniature attack narrative, end to end:
- Administrator takeover: the model exploited a SQL injection to bypass authentication, gain administrator access, and expose user records.
- Sensitive file access: it located restricted files and demonstrated an access-control bypass.
- Cross-site scripting: it validated JavaScript execution in a real browser.
- Business-logic exploitation: it manipulated checkout quantities to create a negative-value order — the kind of logic flaw scanners routinely miss.
- AI-versus-AI prompt injection: it extracted hidden instructions from another AI assistant in a controlled test.
- Autonomous remediation: it discovered a vulnerability, reproduced it, generated a patch, and verified the fix through tests.
The remediation demo is the one security teams will fixate on: finding a flaw is half the job, and the expensive half is proving it matters and shipping a fix that survives the test suite. The business-logic case matters too — scanners are famously bad at logic flaws, because the code does exactly what it says. Understanding that a negative-value order is wrong requires understanding the business, precisely the judgment reasoning models are supposed to bring.
Gated access, real pricing, and an open-weight tease
You cannot just sign up and run Zero 1.5. Access is gated behind OrcaRouter’s Security Research tier: researchers, red teams, and authorized testing organizations must declare a legitimate engagement, provide a passkey, and accept the platform’s terms. Developers call it through an OpenAI-compatible endpoint as orca/orcacyber-zero-1.5.
The pricing is set at $3.00 per million input tokens and $7.50 per million output tokens, with cache reads at $0.75 per million — modest next to frontier general-purpose models, since security workflows burn through tokens on logs and codebases. Then comes the more interesting line in the announcement. Continuum AI says it plans to release an even more capable open-weight cybersecurity model next week, designed for local deployment, so organizations keep direct control over sensitive security workloads instead of sending code and logs to a third-party API.
An open-weight model that finds and validates exploits is a dual-use artifact by definition. The hosted model is gated, the open-weight one is coming, and the justification is organizational control over sensitive data. Compare that with Mistral Large 4’s open-weights preview, where the openness itself was the headline, and you can see a new norm forming — release the weights, but stage the access, and keep the most capable versions behind vetting.
The dual-use question is no longer theoretical
There is a reason the gating matters. A model that can autonomously discover a SQL injection, escalate to administrator access, and patch the hole is, minus the patching step, an automated attacker. Continuum AI keeps “human oversight for consequential actions” in its framing, but the capability is the story — in the wake of reporting like Anthropic’s September threat report, which detailed how state-backed hackers had already been using Claude as a cyber weapon. Who gets to run offensive-capable models, and under what vetting, is moving from policy papers into product pages.
The AI-versus-AI prompt injection demo is a quiet signal of where this goes next. As agent-based systems spread through enterprises, the attack surface is no longer just code — it is other agents. A model that can probe an AI assistant’s hidden instructions is built for a world where the things under test increasingly include the models themselves.
What to watch
Three things will decide whether Zero 1.5 matters beyond launch week. First, independent verification of the benchmark claims — Cybench 100% unrestricted would be a genuine milestone if it replicates. Second, the promised open-weight release next week: its license, its guardrails, and how the security community receives a downloadable exploit-finding model. Third, adoption in real security workflows, where the alerts-to-evidence pitch gets its first honest test.
For now, OrcaCyber Zero 1.5 is a sign of the times: AI security tooling has moved past the demo phase of “look, it found a SQL injection” into the harder business of proving, prioritizing, and fixing — with the thorny access questions arriving right alongside the capabilities.
