Gcsa Agent Achieves 91.3% On Cybergym, Ranking Among The World’s Leading Ai Cybersecurity Agents

What Happened

The Global Cybersecurity Alliance (GCSA) today announced that GCSA Agent achieved a 91.3% success rate on the CyberGym benchmark, placing it within CyberGym’s “Leading Systems Above 90%” category.

Its evaluation environment restores software projects to their pre-patch vulnerable states. An AI agent may need to autonomously identify an issue within a large codebase containing thousands of files and millions of lines of code, and ultimately generate a PoC capable of actually triggering the vulnerability.

Market Context

GCSA Agent demonstrates autonomous vulnerability analysis and PoC generation capabilities on a highly challenging real-world vulnerability benchmark

CyberGym is a large-scale, real-world cybersecurity evaluation framework developed by a research team at the University of California, Berkeley. It contains 1,507 historical real-world vulnerability test cases across 188 major software projects and is designed to evaluate the practical capabilities of AI agents in real-world vulnerability analysis scenarios.

The underlying large language model alone no longer determines the system’s ultimate security capabilities.

The CyberGym evaluation provides a quantitative external benchmark for these capabilities.

Vulnerability Research Capabilities for the Real World

More importantly, further CyberGym research has shown that such agentic security capabilities are not limited to reproducing known vulnerabilities.

GCSA aims to further develop AI Security Agents capable of operating in real-world cybersecurity environments and gradually participating across the full security lifecycle, from vulnerability discovery and analysis to validation and subsequent remediation.

Building AI-Native Cybersecurity Capabilities

Why It Matters

Unlike traditional AI benchmarks that primarily assess code understanding, knowledge-based question answering, or static analysis, CyberGym requires AI agents to work directly within real-world vulnerable code environments.

In its core Level 1 evaluation, an AI agent is provided only with a vulnerability description and an unpatched code repository. It must then autonomously perform code analysis, locate the vulnerability, reason about potential attack paths, construct a PoC, and execute it for validation. A task is considered successful only if the generated PoC successfully triggers the target vulnerability in the vulnerable version while failing to reproduce the issue in the patched version.

Details

CyberGym therefore measures more than whether an AI system can simply “understand code.” It evaluates whether the AI can complete the full process from security analysis to vulnerability reproduction and validation.

From Large Language Models to Security Agents

In this CyberGym evaluation, GCSA Agent operated on Grok 4.5 and Grok 4.6 models and achieved a final success rate of 91.3%.

The result also reflects an important shift taking place in AI cybersecurity:

Real-world vulnerability research typically requires a continuous sequence of tasks, including understanding vulnerability descriptions, searching large codebases, identifying attack surfaces, formulating vulnerability hypotheses, generating test inputs, executing programs, analyzing feedback, and repeatedly iterating on PoCs.

GCSA Agent is built around an agentic security workflow designed to support this end-to-end process.

Its objective is not simply to use a large language model for code analysis, but to enable AI to operate within real execution environments, autonomously formulate hypotheses around security issues, collect runtime evidence, execute tests, and ultimately validate security findings through reproducible results.

A core value of CyberGym lies in narrowing the gap between traditional AI testing and real-world cybersecurity research.

In open-ended vulnerability research experiments, AI agents have identified multiple previously unknown zero-day vulnerabilities as well as historical security patches that did not fully resolve the underlying vulnerabilities. These findings demonstrate the potential for autonomous vulnerability analysis technologies to evolve from reproducing known vulnerabilities toward discovering real-world security flaws.

For GCSA, this represents an even more important direction of development.

Benchmark performance is not the end goal.

As artificial intelligence accelerates software development, AI is also transforming the way vulnerabilities are researched and cyber threats are addressed.