Most abliterated models are text-only, and the ones that are not usually stop at images. Through OrcaRouter one key reaches the whole OrcaCyber line, including its newest member: the MiMo V2.6 Flash abliterated card accepts text, images, audio and video, and returns text [OURS]. Released 2026-10-26 at $0.80 in and $1.60 out per million, it is the only card in the family that can read a recording.
Audio and video input on a security model is not a gimmick. It is a response to where evidence actually lives.
The four input paths and what each is for
| Modality | Typical security artifact |
| Text | Source code, logs, packet dumps, audit notes, tickets |
| Image | Error dialogs, dashboards, architecture diagrams, screenshots of a compromised UI |
| Audio | Captured calls, voicemail, meeting recordings, radio or dispatch audio |
| Video | Recorded sessions, screen captures of an exploit, CCTV, dashcam footage |
The first two are now common. The last two are not, and they change what a single call can ingest. An incident that arrives as a recorded screen session plus a call transcript plus the repository can be reasoned over in one request instead of three pre-processing pipelines.
That matters for a different reason than convenience: every translation step — transcribe, extract frames, describe the diagram — loses information. A model that takes the original media has a chance of noticing what the pipeline would have dropped.
See also: A California Injury Firm Expands to Dallas: What North Texas Accident Victims Should Know
The specification
| Property | Value |
| Input / output per million | $0.80 / $1.60 |
| Cache read per million | $0.15 |
| Context window | 1,048,576 |
| Output ceiling | 131,072 |
| Input modalities | text, image, audio, video |
| Output | text |
| Capabilities | vision, audio, tools, JSON, reasoning |
| p50 first token (7d) | 1,829 ms |
| Output throughput (7d) | 142.1 tok/s |
The envelope is the same million-token context as the rest of the family, with a smaller output ceiling than the Flash tier’s 393,216. That is the trade the card makes: it will look at more kinds of evidence, and it will write a shorter report about it.
Throughput of 142.1 tokens per second is the fastest in the OrcaCyber line, ahead of Flash 1.0’s 138.8 and well ahead of Zero 1.5’s 114.5 [OURS]. A one-day-old card’s throughput figure deserves caution — the sample is small — but the direction is useful: this is not a slow model.
Benchmarks, and the one row to watch
OrcaCyber reports four rows, evaluated 2026-09-21, none independently reproduced [VENDOR]:
• CyberGym — 95.1
• Terminal-Bench 2.1 — 87.6
• DeepSWE v1.1 — 67.9
• SEC-Bench Pro — 47.5
The 95.1 on CyberGym is the highest published figure in the OrcaCyber family, ahead of Flash 1.0’s 88.1 and well ahead of anything the Zero tier publishes on that harness.
The 47.5 on SEC-Bench Pro is the lowest security-engineering row in the family, thirteen points below Flash 1.0’s 62.8.
Read together, those two rows describe a model that is strong at agentic security tasks and weaker at producing finished security work product. That is a coherent profile for a multimodal model: seeing and acting are its strengths; writing the polished audit is not.
What an incident actually looks like
An incident rarely arrives as a tidy text bundle. A realistic packet looks like this:
• a two-minute screen recording of the attacker’s session, captured by a support tool;
• a call recording in which an employee reads out a token;
• four screenshots of error dialogs from the affected service;
• the repository at the commit that was running;
• a week of logs.
On a text-and-image card, the recording and the call have to be transcribed and summarized before anything else happens, which means two extra services and two lossy steps. On this card they go in directly.
The practical preparation is not nothing, though. Three habits make media intake work:
Segment, do not dump. A two-minute clip of the relevant session is more useful than an hour of screen capture, and it leaves budget for the rest of the evidence.
Keep a manifest. Record which file corresponds to which timestamp, so the model’s answer can be traced back to a specific minute of a specific recording. An incident report without provenance is not evidence.
Pair media with text where you have it. The call recording plus the transcript plus the ticket gives the model three views of the same event; a recording alone gives it one.
The remaining constraint is the artifact. At 131,072 output tokens, this card writes a thorough incident report and not a book. If the deliverable has to be longer, the write-up step belongs on the text tier with its 393,216-token ceiling.
What multimodal input does to a prompt budget
A minute of audio and a minute of video each consume tokens. The context window is generous, but the budget is not free, and a workflow that ingests raw media needs a rough plan.
Practical guidance for a one-pass incident review: spend the token budget on the inputs only you can judge. A three-minute screen recording that shows the exploit is worth more than an hour of ambient CCTV. A two-minute call that contains the attacker’s instructions is worth more than a conference recording.
The card’s 131,072-token output ceiling also shapes the deliverable. That is enough for a detailed incident report but not for a book-length one; if you need the longer artifact, the text-only Flash tier carries 393,216.
Where this card fits
Three cases justify it over the text-only Flash tier at the same price. All of them assume the same precondition the whole OrcaCyber line carries: an engagement, a passkey and acceptance of the terms before the endpoint will serve a request [OURS].
Evidence that is not text. If your intake includes recordings, screen captures or captured audio, this is the card in the family that can read them.
Triage that needs the agentic strength. 95.1 on CyberGym describes a model that operates rather than explains, which fits a first-pass agent that probes and reports.
Short, fast reports. At 142 tokens per second, a 4,000-token report takes about twenty-eight seconds of generation.
Cases that do not justify it: long artifacts (use the Flash tier’s larger ceiling), or work that needs the finished engineering deliverable that SEC-Bench Pro at 47.5 predicts will be shaky.
The takeaway
Four input modalities with refusal behaviour removed is a genuinely new shape in this family, and it arrived at the same price as the text-and-image tier: $0.80 and $1.60, a million tokens of context, 131,072 tokens out, and the family’s highest CyberGym row at 95.1 against its lowest SEC-Bench Pro at 47.5.
For incident intake that includes recordings, it is the only card in the line that can look at the evidence directly. For everything else, the sibling is cheaper per artifact and writes more.
Sourcing note: modalities, pricing, context, ceiling and capabilities are from the OrcaRouter model page, checked 2026-10-27 — the card is one day old at that date [OURS]. The four benchmark rows are OrcaCyber’s own claims, evaluated 2026-09-21 and not independently reproduced [VENDOR]. Latency and throughput are OrcaRouter production telemetry for the seven days ending 2026-10-26; the sample is short because the card is new [OURS].
