OrcaCyber releases Zero 1.5, a security model that scores 100% on Cybench at $3 per million tokens

OrcaRouter released OrcaCyber Zero 1.5 this week, a model built for authorized vulnerability research that scores 100% on the Cybench benchmark suite. The company priced it at $3.00 per million input tokens and $7.50 per million output tokens, putting frontier-level cyber scores within reach of teams that found earlier models too expensive to run at scale.

The model is the direct successor to Zero 1.0, which shipped less than a month ago on September 17, 2026. OrcaRouter describes Zero 1.5 as a post-trained model for vulnerability reproduction, exploit development, and penetration testing - not a general-purpose chatbot. The 1-million-token context window and native function calling are what separate it from models that can only discuss vulnerabilities rather than trace them through a codebase.

What the benchmark actually shows

The 100% Cybench score comes from a 24-task CVE-Bench sample. That is a narrow testing surface, and the numbers are self-reported by the vendor shipping the model. Security tooling is a category where inflated benchmark claims cause direct harm - missed vulnerabilities or false confidence in an automated pen-testing pipeline have consequences that a chatbot hallucination does not.

OrcaRouter's framing that Zero 1.5 delivers "fewer reports, more validated fixes" describes a business outcome, not a benchmark result. Independent validation on real-world targets will determine whether the model holds up outside the lab. The fast iteration from Zero 1.0 to 1.5 shows the company is moving quickly, but speed cuts both ways when claims outrun third-party testing.

What the model is built to do

OrcaRouter lists the use cases directly: vulnerability reproduction, exploit development, and penetration testing for authorized security work. The 1M-token context means the model can hold an entire codebase in memory during a session. Native function calling lets it chain exploit steps rather than just describing them. These are practical features for security analysts who need a model that works inside a toolchain, not alongside it.

For professionals in IT, development, and security roles, the useful move is to run an internal evaluation set before trusting the marketing numbers. The price point is aggressive, but price only matters if the model performs on the specific vulnerabilities your organization faces.

Why this matters for IT and development professionals

Security teams evaluating AI-assisted vulnerability research now have another option at a price that makes experimentation cheap. The $3/$7.50 token pricing means a full codebase review costs dollars, not hundreds of dollars. But the 24-task benchmark is a teaser, not a verdict. Run your own tests on CVEs relevant to your stack before building this into a production pen-testing pipeline. For teams building those evaluation skills, structured AI Security Analytics Courses cover the methods for benchmarking models against real attack surfaces.