Sakana AI's original Fugu isn't a model in the usual sense; it's a lightweight router that picks a single frontier model (Gemini, Opus, GPT) per incoming query. Its sibling Fugu Ultra goes further and trains an orchestrator to decompose a task and write a multi-agent workflow to solve it, beating Opus 4.8 on SWE-Bench Pro along the way. Fugu-Cyber, released July 21, 2026, takes that same "system that behaves like a single model" idea and points it at cybersecurity work specifically. It landed the same day Google shipped its own cyber-specialized model, part of a broader pattern across three frontier labs that summer.
What it's built to do
Fugu-Cyber routes and composes calls across the same pool of frontier models, but for security-shaped tasks: verifying whether a suspected vulnerability is real, and translating raw threat-intelligence reports into working detection rules. Sakana reports 86.9% on CyberGym — a benchmark measuring an agent's ability to analyze real codebases and confirm genuine vulnerabilities — and 72.1% on CTI-REALM, which tests turning threat-intel writeups into deployable detection logic. That's a narrower, more specific target than "hack things" — it's built around the unglamorous but critical work of triage and confirmation.
A verification gate built into the architecture
The detail worth dwelling on: if the system surfaces a potential vulnerability, it doesn't get to just say so. Per Sakana, any finding has to be validated by sub-agents specialized in cybersecurity and a human-in-the-loop step, confirming the issue would actually trigger in a real environment, before anything resembling a patch gets proposed. That's not a policy bolted on afterward — it's a structural checkpoint the orchestration pipeline routes every finding through.
Gated on purpose
Access isn't open. You submit a request describing your intended use case and verified contact information, and Sakana's team reviews it manually before granting endpoint access — paired with an updated Acceptable Usage Policy that explicitly bars offensive misuse. For a tool whose whole value proposition is finding real vulnerabilities in real systems, that's the obviously correct default, and it's good to see it stated as plainly as the benchmark numbers.