GCSA Agent Achieves 91.3% on CyberGym, Ranking Among the World’s Leading AI Cybersecurity Agents

GCSA Agent demonstrates autonomous vulnerability analysis and PoC generation capabilities on a highly challenging real-world vulnerability benchmark

The Global Cybersecurity Alliance (GCSA) today announced that GCSA Agent achieved a 91.3% success rate on the CyberGym benchmark, placing it within CyberGym’s “Leading Systems Above 90%” category.

CyberGym is a large-scale, real-world cybersecurity evaluation framework developed by a research team at the University of California, Berkeley. It contains 1,507 historical real-world vulnerability test cases across 188 major software projects and is designed to evaluate the practical capabilities of AI agents in real-world vulnerability analysis scenarios.

Unlike traditional AI benchmarks that primarily assess code understanding, knowledge-based question answering, or static analysis, CyberGym requires AI agents to work directly within real-world vulnerable code environments.

In its core Level 1 evaluation, an AI agent is provided only with a vulnerability description and an unpatched code repository. It must then autonomously perform code analysis, locate the vulnerability, reason about potential attack paths, construct a PoC, and execute it for validation. A task is considered successful only if the generated PoC successfully triggers the target vulnerability in the vulnerable version while failing to reproduce the issue in the patched version.

CyberGym therefore measures more than whether an AI system can simply “understand code.” It evaluates whether the AI can complete the full process from security analysis to vulnerability reproduction and validation.

From Large Language Models to Security Agents

In this CyberGym evaluation, GCSA Agent operated on Grok 4.5 and Grok 4.6 models and achieved a final success rate of 91.3%.

The result also reflects an important shift taking place in AI cybersecurity:

The underlying large language model alone no longer determines the system’s ultimate security capabilities.

Real-world vulnerability research typically requires a continuous sequence of tasks, including understanding vulnerability descriptions, searching large codebases, identifying attack surfaces, formulating vulnerability hypotheses, generating test inputs, executing programs, analyzing feedback, and repeatedly iterating on PoCs.

GCSA Agent is built around an agentic security workflow designed to support this end-to-end process.

Its objective is not simply to use a large language model for code analysis, but to enable AI to operate within real execution environments, autonomously formulate hypotheses around security issues, collect runtime evidence, execute tests, and ultimately validate security findings through reproducible results.

The CyberGym evaluation provides a quantitative external benchmark for these capabilities.

Vulnerability Research Capabilities for the Real World

A core value of CyberGym lies in narrowing the gap between traditional AI testing and real-world cybersecurity research.

Its evaluation environment restores software projects to their pre-patch vulnerable states. An AI agent may need to autonomously identify an issue within a large codebase containing thousands of files and millions of lines of code, and ultimately generate a PoC capable of actually triggering the vulnerability.

More importantly, further CyberGym research has shown that such agentic security capabilities are not limited to reproducing known vulnerabilities.

In open-ended vulnerability research experiments, AI agents have identified multiple previously unknown zero-day vulnerabilities as well as historical security patches that did not fully resolve the underlying vulnerabilities. These findings demonstrate the potential for autonomous vulnerability analysis technologies to evolve from reproducing known vulnerabilities toward discovering real-world security flaws.

For GCSA, this represents an even more important direction of development.

Benchmark performance is not the end goal.

GCSA aims to further develop AI Security Agents capable of operating in real-world cybersecurity environments and gradually participating across the full security lifecycle, from vulnerability discovery and analysis to validation and subsequent remediation.

Building AI-Native Cybersecurity Capabilities

As artificial intelligence accelerates software development, AI is also transforming the way vulnerabilities are researched and cyber threats are addressed.

As software systems continue to grow in scale and complexity, the next generation of cybersecurity will increasingly depend on collaboration between human security experts and autonomous AI agents.

AI Security Agents have the potential to help security teams:

• Identify software vulnerabilities with genuine exploitation potential at an earlier stage;
• Automatically analyse complex attack paths across large codebases;
• Automatically generate PoCs and perform execution-level vulnerability validation;
• Reduce false positives in traditional security detection through real execution results;
• Accelerate vulnerability assessment, validation, and remediation;
• Expand the scale of software and systems that specialised security teams are able to cover.

GCSA Agent’s 91.3% score on CyberGym represents an important milestone in GCSA’s development of AI-native cybersecurity capabilities.

Going forward, GCSA will continue advancing research into autonomous vulnerability analysis, AI Security Agents, and intelligent cybersecurity technologies, further translating frontier AI capabilities into real-world security capabilities and providing technical support for a safer, more trustworthy, and more resilient digital environment.

Source: GCSA Global Cybersecurity Alliance
Official Website: www.gcsa.org

The post GCSA Agent Achieves 91.3% on CyberGym, Ranking Among the World’s Leading AI Cybersecurity Agents appeared first on BeInCrypto.