OrcaRouter launches a faster, less-restricted Xiaomi model for cybersecurity work

OrcaRouter says its new OrcaCyber MiMo V2.6 Flash removes the base model’s refusal behaviour and is designed for authorised security work. The launch pairs a reported lead on one cyber benchmark with weaker results on exploit reproduction, making it a notable tool with a profile that is not quite as simple as “faster is better”.

Watch Desk analysis

What happened

The model is based on Xiaomi’s MiMo V2.6 Flash, but OrcaRouter says it has edited the model’s weights to remove refusal behaviour. The provider says access requires an engagement, a passkey and agreement to its terms. Its launch post describes the model’s capabilities, access conditions and comparisons with OrcaCyber Flash 1.0.

OrcaRouter reports a 95.1% score on CyberGym for the new model, against 88.1% for its sibling. On SEC-Bench Pro, which the post describes as testing vulnerability reproduction, the new model scores 47.5% against 62.8%. The provider also reports faster responses and support for audio and video inputs. These benchmark and performance figures come from OrcaRouter’s own testing, not an independent evaluation. It says the new model’s latency data covers one day and roughly 17,500 tokens, compared with seven days and 17.5 billion tokens for its sibling.

Why it matters

The release puts two questions together: what happens when a general model is adapted for offensive-security tasks, and how much confidence should anyone place in a provider’s own early benchmarks? OrcaRouter’s comparisons suggest the new model may suit some fast analysis tasks better, while its sibling performs better on the cited exploit-reproduction test. The mismatched latency windows make the exact speed comparison especially provisional.

Our read

This is a substantive AI release, not just a new label on a model catalogue. The access restrictions and uneven benchmark results belong in the story alongside the removal of refusal behaviour. Treat the results as the provider’s claims, not as a settled independent scorecard.

What to watch

• Whether OrcaRouter publishes longer-window latency results for the new model.
• Whether an independent evaluator tests the models on the same security benchmarks.
• How the stated access restrictions work in practice.

Discussion spark: Should a model with refusal behaviour removed be available for authorised security work only behind tight access controls, or should independent testing be a condition of release?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.