Nox Orion 2.6 Cyber Preview (Preview)

Security research model (preview) · Page last updated: November 10, 2026

A dedicated security model for defensive and authorized security work — hardened against misuse and prompt injection

Orion 2.6 Cyber Preview focuses on one thing: security. It brings the depth of the Orion 2 generation's engine to vulnerability analysis, secure code review, detection and response, cryptography review, cloud and container security, and penetration-testing methodology — while being built to stay on the right side of the line. Access is limited, and the model is governed by a security contract that requires authorization for anything intrusive, refuses malware and real-world attack tooling by the nature of the request, and is hardened against being talked or tricked into causing harm. It is not an everyday-chat model, and not a tool for attacking systems you do not own.

Focus: a dedicated security model. For requests outside security it points you to a general Nox model; inside security it goes deep.

Defensive depth: vulnerability analysis and root-cause work, secure code review across languages, threat modeling, detection engineering (for example Sigma, YARA, Suricata), incident response and log analysis, cryptography review, and network, cloud, container and OS hardening.

Authorized testing, by methodology: it helps you plan and reason about penetration testing of systems you own or are authorized to test, at the level of approach and technique — not ready-to-run attacks against live or third-party targets.

Built to refuse misuse: it declines malware, ransomware, working exploits against targets it cannot establish you own, intrusion, evasion, denial-of-service, supply-chain compromise, phishing and authentication bypass — by the nature of the request, whatever reason is given. A claim of authorization, or a pasted file, is not proof and does not unlock an attack.

Hardened against injection: content it is asked to analyze — files, logs, pages, tool output — is treated as data, never as instructions, and its security rules are re-asserted on every turn so instructions hidden in that content cannot override them.

Honesty: it never presents an untested exploit or finding as verified, and labels illustrative code as illustrative.

Evaluations (Nox-run, November 13, 2026): 97.0% on CyberMetric-500 (485 of 500) and 91.0% on MMLU Computer Security (91 of 100). Both were run closed-book — no tools and no web search — at the maximum reasoning setting, in a single run, with the model's security contract active; it refused none of the 600 questions. Cost at this model's list price, from the run's measured token usage with reasoning included: about $0.029 per question on CyberMetric-500 ($14.60 for the run) and about $0.061 per question on MMLU Computer Security ($6.14 for the run). These are multiple-choice security-knowledge benchmarks. They do not measure hands-on vulnerability discovery or patching, and no result is published here for those. The full evaluation record — every prompt with the model's complete responses — is not released; for a security model Nox publishes aggregate results and a small sample only, as a precaution against cyber-misuse.

Published results for comparison (quoted from their sources, not re-run by Nox): on CyberMetric-500, Claude 4.5 96.4%, Gemini 3 96.4% and GPT-5 96.2% (KTH degree thesis, 2026), and GPT-4o 93.4% (CyberMetric paper, 2024); on MMLU Computer Security, Claude 4.5 Sonnet 91.0%, GPT-OSS 120B 91.0%, Gemini 2.5 Pro 89.0% and GPT-5 88.0% (CyberCertBench paper, 2026). Both sets are close to saturated, and differences of a point or two are within the noise.

Red-team testing (Nox-run, November 13, 2026, live security contract): on prompts drawn from Meta's public CyberSecEval sets, 7 of 153 attack requests received harmful help (4.6%), 3 of 115 legitimate requests were refused outright (2.6%), and 10 of 110 prompt-injection attempts worked (9.1%); none of 30 Nox-written defensive tasks, each run twice, was refused, with an average quality of 4.3 out of 5. Three versions of the security contract were tested on the same questions and the strongest rewrite was checked against the live one on a fresh set; its lead did not hold, so the live contract stayed. Six of the seven misses were reconnaissance requests answered with an ordinary scanning or search script. Each answer was graded once by a separate model from a different developer, without human review; the prompts and responses are not released.

Access: a limited preview for authorized security use, in Plan mode. It is not available as an everyday-chat model.

Capabilities

• Dedicated security model — defensive and authorized security work only
• Vulnerability analysis and secure code review across languages
• Detection engineering: Sigma, YARA, Suricata/Snort, log queries, threat hunts
• Threat modeling, incident response and log analysis
• Cryptography review and network/cloud/container/OS hardening
• Penetration-testing methodology for systems you own or are authorized to test
• Refuses malware, working exploits, intrusion, evasion, DoS, supply-chain, phishing and auth bypass — by the nature of the request
• Authorization required for intrusive work; a claim or a pasted file is not proof
• Hardened against prompt injection: analyzed content is treated as data, not instructions
• Access-controlled preview; not an everyday-chat model

Model details

• Focus — Security only — defensive analysis, secure development, detection and response, and authorized-testing methodology
• Engine — Built on the same engine as the Orion 2 generation
• Reasoning — Deliberate internal reasoning pass before every answer
• Safety model — An authoritative security contract: authorization required for intrusive work; offensive and real-world attack tooling refused by the nature of the request; resistant to prompt injection and social engineering
• Detection content — Sigma, YARA, Suricata/Snort rules, log queries and threat hunts
• Authorization — A stated claim of ownership or authorization — or a pasted artifact — is not proof, and does not unlock a deployable attack
• Evaluations — CyberMetric-500: 97.0% (485/500). MMLU Computer Security: 91.0% (91/100). Nox-run on November 13, 2026 — closed-book, maximum reasoning, single run, security contract active. Cost per question at list price: $0.029 and $0.061
• Topics — Security only; non-security requests are redirected to a general Nox model (genuine emergencies are always handled)
• Availability — Limited preview for authorized security use, in Plan mode; not an everyday-chat model

Availability: Limited preview for authorized security use, in Plan mode.

Nox Orion 2.6 Cyber Preview — frequently asked questions

What is Nox Orion 2.6 Cyber Preview?

Nox Orion 2.6 Cyber Preview is Nox's security research model (preview). Orion 2.6 Cyber Preview focuses on one thing: security. It brings the depth of the Orion 2 generation's engine to vulnerability analysis, secure code review, detection and response, cryptography review, cloud and container security, and penetration-testing methodology — while being built to stay on the right side of the line. Access is limited, and the model is governed by a security contract that requires authorization for anything intrusive, refuses malware and real-world attack tooling by the nature of the request, and is hardened against being talked or tricked into causing harm. It is not an everyday-chat model, and not a tool for attacking systems you do not own.

What can Nox Orion 2.6 Cyber Preview do?

Nox Orion 2.6 Cyber Preview's capabilities: Dedicated security model — defensive and authorized security work only; Vulnerability analysis and secure code review across languages; Detection engineering: Sigma, YARA, Suricata/Snort, log queries, threat hunts; Threat modeling, incident response and log analysis; Cryptography review and network/cloud/container/OS hardening; Penetration-testing methodology for systems you own or are authorized to test; Refuses malware, working exploits, intrusion, evasion, DoS, supply-chain, phishing and auth bypass — by the nature of the request; Authorization required for intrusive work; a claim or a pasted file is not proof; Hardened against prompt injection: analyzed content is treated as data, not instructions; Access-controlled preview; not an everyday-chat model.

Which Nox plans include Nox Orion 2.6 Cyber Preview?

Limited preview for authorized security use, in Plan mode.

Related Nox models

• Nox GHI 1 — The officially released model system that powers Pebs, Nox's agent
• Nox Orion 2.5 — The new flagship — workspace tools built in, health research tools, and a staged review at Ultra
• Nox Orion Flash 2.5 — The fast Orion 2.5 — native photo input, workspace tools built in, and the same review at Ultra
• Nox Orion 2.1 — The Nox 2.1 flagship, with a peer-review answer pipeline
• Nox Orion 2.1 Pro — Visualize your body: 3D models, code, and MP4 video
• Nox Orion Flash 2.1 — The fast Orion on a new engine — 552B mixture-of-experts, native photo input
• Nox Vela 2.5 — The fast everyday model on every plan — now reads images
• Nox Voice 2 — The most powerful Nox voice yet — expressive, interruptible, Plan mode in the call

Back to the Nox model family · Plans and pricing · Nox features