Introduction
Today we’re introducing Vantulo, a large, powerful model built for cybersecurity.
Security work asks a lot of a model. It has to read unfamiliar code closely, follow how a system actually behaves rather than how it was meant to, and reason carefully about where things break. Vantulo was built for that kind of work. It reasons step by step before it answers, and it can search the web when a question depends on something current.
Releasing a model this capable comes with risks. The same understanding that helps a defender harden a system can help someone attack one, and we don’t think that tension gets resolved by pretending it isn’t there. So Vantulo does not ship open. It ships with safeguards that block cybersecurity requests by default, along with requests involving biological or chemical harm, and it opens up for security work only to people who verify who they are.
- Built for security workVantulo scores 87.3 on CyberGym, ahead of the other frontier models we measured against.
- Safeguards on by defaultA separate guard model screens every request and every reply as it streams, in three categories.
- Verification for professionalsA government ID and a live face check unlock the security work the default safeguards hold back.
- Malware stays blockedFor everyone, verified or not. Verification widens what Vantulo will help with; it does not remove the floor.
Performance
We evaluated Vantulo on CyberGym, a benchmark of real-world cybersecurity tasks, against the strongest models we had access to. Vantulo scored highest.
| Model | CyberGym | Gap to Vantulo |
|---|---|---|
| Vantulovantulo.com | 87.3 | — |
| GPT 5.6 SolOpenAI | 83.6 | −0.9 |
| Claude Fable 5.1Anthropic | 83.8 | −4.4 |
A benchmark is a narrow instrument, and a few points on one evaluation is not the whole picture of how a model behaves on real work. We report it because it’s the clearest signal we have, not because it settles the question.
Safeguards
Vantulo is guarded by a second model that runs alongside it. That guard sees the conversation before Vantulo answers, and it sees Vantulo’s reply as the reply is being written. Both directions matter: a request can look harmless and still be steering toward something that isn’t, and a reply can drift somewhere the request never went.
What the guard blocks
Three categories, judged on real intent and operational specificity rather than on whether a scary word appeared:
- Cybersecurity — blocked by default for everyone, including defensive and educational requests, until an account is verified.
- Biological harm — weaponizing pathogens or toxins, or making them more transmissible, more lethal, or harder to detect or treat.
- Chemical and explosive harm — chemical weapons, nerve agents, explosives and incendiary devices, and poisons meant to be used against people.
General science, medicine, public health, history and policy are not blocked, and neither is fiction or high-level description that gives nobody anything actionable. The biological and chemical limits are fixed. No amount of verification moves them.
The same guard runs on the API. Requests, system instructions, tool definitions, and the generated reply are all screened, so an application built on Vantulo inherits the safeguards rather than routing around them.
Cyber Verification
Blocking all cybersecurity by default is a blunt rule, and we know who it lands on: the defenders, the students, the people running a CTF on a Saturday. The Cyber Verification Program is how we lift it for them without lifting it for everyone.
Verification checks a government ID and a live face. It takes a few minutes and runs through an identity provider, so what comes back to us is a decision, not your documents. We store whether you passed. We do not store a copy of your ID or your face.
Unlocked once verified
- Defensive and blue-team work
- Capture-the-flag competitions
- Vulnerability research
- Exploit development
- Penetration testing
- Red-team work
- Detection, hardening, incident response, and log analysis
Blocked for everyone
- Ransomware
- Spyware and stealers
- Trojans, viruses, and worms
- Keyloggers and rootkits
- Botnets and other malicious payloads
- Biological and chemical harm
Verification is not a licence. It is an identity: an account attached to a real person who can be held responsible for what they ask for. That is the trade. We give up the anonymity of the request, and in exchange the model can be genuinely useful for security work instead of reflexively refusing it.
Apply for Cyber Verification
A government ID and a live face check. A few minutes, once.
Availability
Vantulo is available today at vantulo.com. Create an account, and you can talk to it in the browser with reasoning and web search on.
It is also available through an API. Vantulo speaks both shapes the ecosystem already uses, so an existing OpenAI or Anthropic client works by changing the base URL and the key. Create a key from the account menu, then point your client at it.
curl https://vantulo.com/v1/chat/completions \
-H "Authorization: Bearer vnt_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"vantulo","messages":[{"role":"user","content":"Hello"}]}'Use vantulo-thinking to have it reason before answering, or send web_search: true to let it look things up. The Anthropic-shaped endpoint lives at /v1/messages and takes the same key. Full details are in the API reference.
Safeguards apply everywhere. There is no endpoint, parameter, or plan that turns them off.