Xiaomi's MiMo-V2.6 clears CyberGym at 94.0 under an MIT licence, but ExploitBench at 47.9 shows the audit-to-exploit gap is still wide open.
Xiaomi released and open-sourced the MiMo-V2.6 series on 22 September 2026, led by a 1.02-trillion-parameter flagship that posts 94.0 on CyberGym — the first score to clear the 83-to-85 band where frontier models had been clustered since GLM-5.3 arrived in August. The weights, a technical report, more than 7,000 reinforcement-learning task environments, and a set of composable cybersecurity harnesses all shipped under the MIT licence on day one.
The headline number is real, but it is not the part that should change anyone's threat model. MiMo-V2.6-Flash — a 309B model that costs $0.42 per million tokens — scores 95.1 on the same benchmark, beating the flagship, while landing at roughly half the flagship's score on every evaluation that requires turning a discovered bug into a working exploit. That inversion is the most useful signal in the release: CyberGym Level 3 has saturated, and the capability that actually matters is still gated behind a gap MiMo has not closed.
What a 94 on CyberGym Actually Measures
CyberGym spans 1,507 real vulnerabilities drawn from 188 OSS-Fuzz projects, and it is scored across four information tiers. The distinction between them is the whole story:
- Level 0 (black-box): no vulnerability description supplied. Industry baseline sits near 3.5%.
- Levels 1 and 2: a bug description, then an added AddressSanitizer crash trace. Top agents plateau around 20% to 22%.
- Level 3 (white-box): the contextual source diff and post-patch codebase are handed to the agent, which then reproduces the crash.
Published MiMo scores reflect Level 3. At that tier the task is closer to guided reproduction than to discovery, and the leaderboard shows exactly the compression you would expect from a saturating benchmark.
| Model | CyberGym (Level 3) | Licence |
|---|---|---|
| MiMo-V2.6-Flash (Xiaomi) | 95.1 | MIT |
| MiMo-V2.6-Pro (Xiaomi) | 94.0 | MIT |
| DeepSeek V4.1 Flash | 88.1 | Open weights |
| GPT-5.6 Sol (OpenAI) | 84.5 | Closed API |
| Claude Mythos 5 (Anthropic) | 83.8 | Closed API |
| GPT-5.5 / GPT-5.6 Terra (OpenAI) | 81.8 | Closed API |
| Claude Opus 4.7 Adaptive (Anthropic) | 73.1 | Closed API |
The tell is that Flash outscores Pro. A 309B model with 15B active parameters should not beat a 1.02T model with 42B active on a task that genuinely discriminates security capability. When the cheap model ties or beats the flagship, the benchmark has stopped measuring the thing its name suggests. Treat any CyberGym figure above 90 as evidence of benchmark saturation, not of a step change in offensive capability.
The Gap That Did Not Close
Run the same two models against evaluations that require multi-stage exploit synthesis rather than crash reproduction, and the ordering snaps back — along with a wide deficit against the closed frontier.
| Evaluation | MiMo-V2.6-Pro | MiMo-V2.6-Flash | Claude Opus 5 | GPT-5.6 Sol | What It Measures |
|---|---|---|---|---|---|
| CyberGym | 94.0 | 95.1 | — | 84.5 | Guided crash reproduction |
| ExploitBench | 47.9 | 25.3 | 70.0 | 78.5 | Multi-stage exploit synthesis |
| ExploitGym | 17.8 | 6.0 | 22.1 | 30.3 | Autonomous end-to-end compromise |
| SEC Bench Pro | 66.3 | 47.5 | — | 79.1 | Applied security engineering |
| MiMo Cyber Bench | 80.2 | — | — | — | Vendor-internal suite |
Pro trails GPT-5.6 Sol by 30.6 points on ExploitBench and 12.5 on ExploitGym. Flash — the model that just won CyberGym outright — solves barely a fifth of what Sol does on ExploitGym. The audit-to-exploit gap that the GLM-5.3 release exposed in August is not merely intact; relative to its CyberGym lead, MiMo's version of that gap is wider.
MiMo-V2.6-Pro leads on guided crash reproduction and trails GPT-5.6 Sol by 30.6 points on multi-stage exploit synthesis.
For defenders, the practical read is that MiMo-V2.6 is a high-throughput bug-finding and triage engine, not an autonomous attack tool. It will surface crashes and localise flaws at volume. It will not reliably chain them into working intrusions without a competent operator.
The Real Change Is the Absence of a Gate
Capability is the wrong axis to watch here. Distribution is the right one.
GLM-5.3 hit 84.5 on CyberGym in August and its weights were held back for safety hardening. MiMo-V2.6 hit 94.0 and shipped the same day, under MIT, with no acceptable-use policy attached, alongside:
- 7,000-plus RL task environments, published openly — the training scaffolding, not just the artefact.
- Composable mini-harnesses for coding, professional workflows, visual tasks, and cybersecurity specifically.
- HarnessX, a framework permitting dynamic harness rewriting mid-task, reported at a 14.5% average absolute gain across 15 model-benchmark combinations.
- A MiMo-V2.6-Distill-Qwen-9B variant, small enough to run on a single consumer GPU.
- Aligned RL training that Xiaomi describes as environment hardening, adversarial screening, and verifier cross-checks — measures aimed at reward hacking during training, not at refusing misuse at inference. Confirmed reward-hacking trajectories were held below 2% in the final run.
There is no rate limit on a downloaded checkpoint, no abuse review, no KYC, and no refusal behaviour that a fine-tune cannot strip. Every API-level safeguard that constrains how GPT-5.6 Sol or Claude Opus 5 can be pointed at a codebase is simply absent. The 30-point ExploitBench deficit is the only thing standing between this release and a materially different picture, and deficits of that size have historically closed within two model generations.
Who Can Actually Run It
Self-hosting the flagship is not a laptop exercise, and that constrains the near-term risk.
- MiMo-V2.6-Flash: 309B total, 15B active, 48 layers, 256 routed experts with 8 activated. Weights ship as 172.9 GB of FP8 (e4m3) across 65 shards. Recommended serving is SGLang at tensor-parallel 16 with data-parallel 2, or vLLM at tensor-parallel 8 — a multi-node GPU job.
- MiMo-V2.6-Pro: 1.02T total, 42B active. Substantially heavier again.
- Both: 1M-token context, up to 128K output tokens, native text, image, audio, and video input.
The practical bypass is that nobody needs to self-host. Flash is served through Xiaomi's API at $0.14 input / $0.28 output per million tokens, and Pro at $0.435 / $0.87 — against roughly $30 per million for Claude Opus 5. Artificial Analysis puts MiMo-V2.6-Pro at an Intelligence Index score of 46 for about $0.13 per task, versus $5.86 for Opus 5 and $1.99 for Sol. Quantised builds are already circulating for llama.cpp and Ollama, and the 9B distill runs on commodity hardware.
Cost per vulnerability-reproduction attempt, not raw capability, is the number that moved.
What Security Teams Should Do
Assume high-volume, low-cost bug discovery against your open-source dependencies is now a standing condition. The economics favour running Flash across an entire dependency tree rather than triaging targets first. Projects with thin maintainer capacity are the exposed surface.
Prepare for report volume, not breach volume. The GLM-5.3 cycle produced a roughly 21% true-verification rate against high automated discovery throughput. Expect the same asymmetry: inbound findings that are cheap to generate and expensive to confirm. Triage capacity, not detection, is the bottleneck that breaks first.
Use it defensively before someone else uses it otherwise. An MIT licence cuts both ways. Crash-dump triage, multi-file dependency tracing, and patch synthesis are exactly where these scores are legitimate, and running Flash in-house carries no data-residency argument against it.
Watch ExploitBench, not CyberGym. CyberGym above 90 is now a saturated signal. The number that will indicate a genuine shift in open-weight offensive capability is an MIT-licensed model closing on GPT-5.6 Sol's 78.5 on ExploitBench. MiMo-V2.6 sits 30 points short. The next release may not.