OrcaRouter has released OrcaCyber Zero 1.5, a model for authorized vulnerability research. The model is the successor to OrcaCyber Zero 1.0, which shipped on September 17, 2026. OrcaCyber Zero 1.5 is a post-trained Orca model for vulnerability reproduction, exploit development and penetration testing. It ships with a 1M-token context window, native function calling and structured outputs. For security teams, this model brings a simple message: fewer reports, more validated and fixed vulnerabilities.
TL;DR
- Size: Parameter count not disclosed. 1M-token context, 128K max output, text in and text out.
- Runs on: Hosted API only through OrcaRouter. No weights, no quantized variants, hardware not disclosed.
- Performance: Vendor-reported scores are near ceiling on cyber benchmarks and strong on coding.
- Best: 100% on Cybench (39/39 tasks, unrestricted agent execution).
- Worst: 76.5% on SWE-bench Pro V2, its lowest published score.
- Bottom line (best): Top-tier cyber scores at $3.00 / $7.50 per 1M tokens.
- Bottom line (worst): Every number is self-reported, and CVE-Bench used only 24 evaluable tasks.
What is OrcaCyber Zero 1.5?
OrcaCyber Zero 1.5 is a frontier cybersecurity model and the successor to Zero 1.0. Orca team states that it has post-trained for security research and authorized security engineering. Listed uses include vulnerability reproduction, exploit development, penetration testing, security auditing and cyber reasoning.
The 3 design goals:
- Find what others miss: unknown flaws like RCE, sandbox escapes, auth bypasses, privilege escalation and attack chains.
- Go beyond detection: reason through attack paths, challenge its own hypotheses and rank flaws by demonstrable exploitability.
- Built for autonomous agents: 1M-token context, native tool calling and extended reasoning for large codebases.
How does OrcaCyber Zero 1.5 perform on benchmarks?
The model page lists 4 vendor-reported results, last evaluated October 10, 2026:
- Cybench: 100% (39/39, unrestricted agent execution).
- CVE-Bench: 95.8% (23/24 evaluable tasks).
- HumanEval+: 93.9%.
- SWE-bench Pro V2: 76.5%.
Cybench contains 40 professional CTF tasks, so the 100% covers 39 of them. CVE-Bench is built on 40 critical-severity web CVEs. Orca’s 95.8% covers a 24-task evaluable subset. The SWE-bench Pro V2 score is not directly comparable with standard SWE-bench Pro results.
