Cyber-specialized AI went from one lab's experiment to a four-way market in months. As of November 5, 2026, OpenAI, Microsoft, Sakana AI and Google each have a security-focused model or system. Anthropic's Mythos line plays in the same field with a different access model, covered in GPT-6 Cyber vs Claude Mythos.
The trouble is that their headline numbers do not compare. This post lays out what each product is, what the number means, how to get access, and which claims you can set side by side.
TL;DR: the four models at a glance
| Question | GPT-6 Cyber | MAI-Cyber-1-Flash | Fugu-Cyber | Gemini 3.5 Flash Cyber |
|---|---|---|---|---|
| Maker | OpenAI | Microsoft AI | Sakana AI | |
| Launch | November 5, 2026 | July 27, 2026 | July 21, 2026 | July 21, 2026 |
| What it is | Security-trained model | Compact security model inside the MDASH harness | Multi-agent orchestration model behind one endpoint | Security-only Flash model tied to CodeMender |
| Headline score | 48.5% ExploitGym | 95.95% CyberGym (full MDASH system) | 86.9% CyberGym; 72.1% CTI-REALM | No comparable headline in our coverage |
| Access | Select Daybreak Red customers, expanding | Private preview sign-up | Application, manual review | Via CodeMender |
| Public price | None | None | From 6 dollars input, 36 dollars output per million tokens | Not stated |
| Direction | Offense and defense, authorized | Discovery and remediation | Defense; policy prohibits offensive misuse | Defense |
GPT-6 Cyber: the exploit specialist
OpenAI's model is built to find and validate exploitable vulnerabilities, and to stay inside the scope a researcher sets. It scores 48.5% on ExploitGym, completed 95% of RemoteExploitBench tasks, and reached 40.3% recall on a new web penetration test. OpenAI rates it Critical in cybersecurity under its Preparedness Framework.
Its field claims are the biggest on the list: working exploits for 948 Linux kernel vulnerabilities and 81 high-severity Firefox vulnerabilities, per OpenAI's announcement. It is also the only one here with a published scope test, ExploitGym Honeypot, where it avoided out-of-scope exploitation in 99.93% of runs without deployment prompts. Our full GPT-6 Cyber report has the detail, and the GPT-5.6 Cyber comparison covers the upgrade question.
MAI-Cyber-1-Flash: the routed, cost-saving system
Microsoft's model is a compact, code-heavy security model derived from its MAI-Thinking-1 lineage. It does not run alone. It is one component of MDASH, a harness with more than 100 agents built on multiple leading models.
The design point is routing. MAI-Cyber-1-Flash handles roughly 90% of tasks by itself, and the hardest 10% go to GPT-5.4. Microsoft claims this is about 50% cheaper than its prior best MDASH stack. Its 95.95% CyberGym score is for the full system, model plus GPT-5.4 fallback, against 83.2 to 85.6% for the Mythos, Gemini and GPT comparisons Microsoft cited.
The limit: CyberGym measures finding vulnerabilities, not fixing them correctly. Access is private preview only. Read the details in our MAI-Cyber-1-Flash report.
Fugu-Cyber: the managed, defense-only orchestrator
Sakana's pitch is that a raw frontier API is not an enterprise security program. Fugu-Cyber delegates across specialized agents, verifies the work and synthesizes one answer behind an OpenAI-compatible endpoint. Sakana reports 86.9% on CyberGym and 72.1% on CTI-REALM, which tests threat-intelligence reasoning, a different task.
It is the most transparent on access and price: an intended-use application with verified contact details, manual review, Token Plan or pay-as-you-go only, and fugu-cyber-v1.0 from 6 dollars per million input tokens and 36 dollars per million output tokens. Its acceptable use policy prohibits offensive misuse. The trade-off is opacity: the underlying agents and routing are proprietary, which matters for teams with data-residency or audit rules. See our Fugu-Cyber coverage.
Gemini 3.5 Flash Cyber: the quiet entry
Google shipped three models on July 21: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite and a security-only Gemini 3.5 Flash Cyber that works through CodeMender. Google gave no cyber benchmark headline in the coverage we reviewed, and the launch was dominated by the missing Pro model. Of the four it is the hardest to evaluate from public data. See our Gemini 3.6 Flash and Cyber launch report.
Can you compare the scores?
Mostly no. This table shows why.
| Benchmark | Reported by | Measures | Task type |
|---|---|---|---|
| ExploitGym | OpenAI | Exploiting a specified vulnerability in a remote target | Exploitation |
| RemoteExploitBench | OpenAI | Exploits against known flaws in GitLab, PostgreSQL and Jenkins | Exploitation |
| CyberGym | Microsoft, Sakana | Reasoning over large codebases to find real vulnerabilities | Discovery |
| CTI-REALM | Sakana | Threat-intelligence reasoning | Analysis |
| ExploitGym Honeypot | OpenAI | Staying in scope when out-of-scope services are easy to exploit | Alignment |
Three consequences follow.
- 48.5% is not lower than 95.95%. They are different tests. A system could score high on discovery and low on exploitation.
- System scores and model scores differ. Microsoft's number is for MDASH with a GPT-5.4 fallback, not the model alone.
- Vendors choose their benchmarks. OpenAI reports exploit and scope tests where it leads its own earlier models. Microsoft and Sakana report CyberGym, where they lead the comparison set they picked. None ran the others on a shared harness.
Our AI benchmarks guide explains why harness and settings move scores, and the ExploitBench explainer shows the same problem in exploit generation.
Which one fits which job?
| Job | Closest fit |
|---|---|
| Authorized exploit validation and red teaming | GPT-6 Cyber |
| Vulnerability discovery at large codebase scale, with remediation | MAI-Cyber-1-Flash inside MDASH, if you can join the preview |
| A managed defensive service with audit-friendly access rules | Fugu-Cyber |
| Patch assistance tied to Google tooling | Gemini 3.5 Flash Cyber through CodeMender |
| Workflow-first scanning in Claude Enterprise | Claude Security; see our Mythos comparison |
What does the guardrail debate mean for you?
In July, defenders complained that hosted models refuse legitimate exploit-adjacent work, while vendors pointed to real dual-use risk. We covered it in AI cyber guardrails block US defenders. The four products answer that tension in four ways: OpenAI gates by vetting and monitoring, Sakana by application and policy, Microsoft by private preview, and Google by tying the model to a narrow tool.
One more layer is yours to add. None of these vendors removes the need to control what an AI agent can do on your own machines and pipelines. That is a separate problem from finding bugs, and we cover it in GPT-6 Cyber vs AgentBeam.
Our advice
- Pilot on your own code. Compare confirmed, patched findings, not raw counts.
- Ask each vendor for the harness and settings behind its number.
- Keep a human in the loop for every claimed vulnerability and every action.
- Do not pick a model from a leaderboard that does not include your task.
Scores, prices and access terms are as published by each vendor between July and November 2026 and may change. This is analysis, not a procurement recommendation.
What should you ask each vendor before you buy?
A leaderboard cannot settle this, but a short list of questions can. Put these to every vendor, including OpenAI, before a pilot.
What exactly does the score measure? Ask whether the number is for the model alone or for a system. Microsoft's 95.95% is for MDASH, which includes a GPT-5.4 fallback for the hardest tasks. OpenAI's ExploitGym number is for the model in OpenAI's own harness. A system score and a model score are different products.
What harness and settings produced it? Tool access, time limits, the number of attempts and the scoring rules all move results. Our ExploitBench explainer shows how a small change in setup shifts exploit-generation scores. Ask for the configuration, not only the percentage.
How many findings were confirmed and patched? A count of reported vulnerabilities says little until someone triages it. The useful figure is the share that maintainers accepted and fixed. OpenAI points to Mozilla fixes for the Firefox findings, which is the kind of external confirmation to look for in every case.
What happens to your data? OpenAI describes Private Safety Processing for Zero Data Retention API customers, with encrypted records kept in customer storage for 30 days. Sakana's managed endpoint keeps its internal execution graph proprietary. Your legal and security teams need to know where code and prompts travel.
What is the acceptable use policy? Sakana's policy prohibits offensive misuse. OpenAI's Daybreak Red is designed for authorized exploit development. Match the policy to the work you actually do, because a model that is a good fit technically can still be the wrong contract.
What is the failure mode? Ask what the vendor has measured about the model leaving its scope, hallucinating a vulnerability, or reporting a result it did not verify. OpenAI publishes a scope test and says the model was trained to report results accurately. Ask the others for their equivalent.
Why the numbers will keep diverging
Cyber benchmarks are young, and each lab has an incentive to report the test it leads. As models improve, older benchmarks saturate and labs publish new ones, which is why OpenAI introduced RemoteExploitBench and a web penetration test alongside GPT-6 Cyber. Expect the same pattern from the other three. The practical response is to keep a small, private evaluation set drawn from your own software, with known bugs you have already fixed, and run every candidate against it. That gives you a number no vendor chose.