Through OrcaRouter the card's capability line reads `vision, tools, JSON, reasoning`, and the modalities line reads text, image, video [OURS]. The Qwen3.8 Flash Next benchmarks page is worth reading for that third input alone, because video is the one modality security tooling almost never uses. The card runs at $0.80 in and $1.60 out per million, with a 262,144-token window.
Video is where evidence lives that nobody transcribes, and that is precisely why it is worth a paragraph in a buying decision.
Three properties make video the least-processed input in an incident.
It is large. A screen recording is minutes of pixels where a log file is lines of text. Storage is cheap, so it accumulates.
It needs a tool to read. An analyst can glance at a screenshot; a video requires scrubbing, which nobody does during triage.
Its content is usually a sequence. What matters is often the transition — a click that opens a dialog, a command that returns an error, a file that disappears. A single frame loses exactly the part that matters.
A model that accepts video can consume that sequence directly. A model that does not forces you to choose between transcribing, sampling frames, or ignoring the evidence.
The page's own use-case text describes screenshots of interfaces and error states, network and architecture diagrams, dashboards, recorded sessions, and scanned material being reasoned over alongside source code and long textual context [OURS].
Recorded sessions are the video case. The interesting property is not that the model can describe a frame — any image model can — but that it can relate a sequence of frames to a textual claim. "The recording shows the service returning 502 after the config change" is a cross-modal statement, and it is the kind an incident report needs.
Video is the most token-expensive modality per second of evidence, and the exact rate depends on how the model samples frames and at what resolution. Nobody should plan a pipeline around a guessed ratio.
What can be planned is the envelope: 262,144 tokens total for the whole request [OURS]. If a recording is one input among several, it competes with the code and the logs for the same budget.
Three habits keep it workable:
Send the segment, not the file. A two-minute clip around the event beats an hour of ambient capture, both in tokens and in signal.
Put the text you have next to the video. A log excerpt with timestamps makes the recording checkable; a recording alone asks the model to infer everything.
Ask for timestamps in the answer. A finding that says "at 01:47 the dialog shows an expired certificate" can be verified in seconds. One that says "there appears to be a certificate problem" cannot.
Two cards in the OrcaCyber line accept video: this one and the MiMo-based card. Both are $0.80 and $1.60. The differences that matter for video work are the window and the ceiling — MiMo carries 1,048,576 tokens of context and this card carries 262,144, while both cap output at 131,072 [OURS].
For a request that is mostly video, that difference in context is the deciding spec. An hour of recorded session plus its logs will not fit in a quarter of a million tokens; it may fit in a million.
For a request that is a short clip plus source code, the window rarely binds and the choice falls back to benchmark profile — which is a subject for the companion articles on the two cards.
It returns text, not frames, not annotations, not a rendered timeline [OURS]. Output is prose or JSON, up to 131,072 tokens.
That matters for tooling: if your pipeline expects a visual artefact, this card produces the description of one. The description is the part a downstream agent can actually act on, which is usually the point.
It also means video evidence enters the record as text — and text is what you can diff, cite and attach to a ticket. A recorded session that has been described in an incident timeline becomes reviewable by everyone who was not in the room.
Three practical notes, learned from image input generally and applied to video.
Start before the interesting moment. A clip that begins at the failure gives the model no baseline to compare against.
Keep the resolution honest. Downscaling to save tokens also removes the small text an analyst needs to read.
Label the timeline in the prompt. "Frames 0–30 seconds show the login page" costs a few tokens and saves the model from inventing a context it cannot see.
None of these is specific to this card. All of them determine whether video input is useful or merely present.
A recording on its own is an observation. A recording attached to the log lines it produced is evidence, because the two can be checked against each other.
That is the strongest reason to send video and text in the same request rather than in two. The model can align a timestamp in the clip with a timestamp in the log and say whether they agree — a claim that neither input supports alone. It is also the kind of claim an incident report is actually built from.
Practically, that means assembling the request before writing the prompt: the clip, the log slice for the same window, and one sentence naming what the reviewer should look for.
Video input on a refusal-free security model is a capability almost no competing tool offers, and it addresses evidence that otherwise goes unread. The constraint is arithmetic: 262,144 tokens total, and video is the hungriest input in the request.
Use it for segments, pair it with text you already have, demand timestamps in the answer — and if your evidence is long recordings rather than short clips, pick a card with a million-token window instead.
One framing that helps when justifying the capability internally: video input is not a feature for watching more video, it is a way to stop losing evidence that was already being collected. The recordings exist whether or not anything reads them; the question is only whether they enter the review.
Sourcing note: modalities, capabilities, context windows, output ceilings and prices are from the OrcaRouter model pages for both cards, checked 2026-10-27 [OURS]. No token-per-second-of-video ratio is asserted, because it depends on the serving stack's frame sampling. Benchmark rows are not used to support any claim about video handling.
