CyberGym results show AI surpasses 90% in vulnerability detection

A year ago, AI agents could barely reproduce one in four known software vulnerabilities when handed the bug description and the broken code. Now the best ones nail it more than nine times out of ten. That’s the headline finding from CyberGym, a benchmark built by UC Berkeley researchers to measure how well AI agents can autonomously reproduce real-world security vulnerabilities. The current leaderboard leader, a Sangfor AI Agent running on DeepSeek-V4-Flash, posted a 93.2% success rate. Three other agents cracked the 90% barrier as well, with scores of 91.2%, 91.0%, and 90.9%. What CyberGym actually measures CyberGym draws from 1,507 real vulnerability instances across 188 open-source software projects, with most of the data sourced from Google’s OSS-Fuzz corpus. Each challenge works like this: an AI agent receives a vulnerability description alongside the unpatched source code. Its job is to generate a proof-of-concept test that triggers the bug, essentially crashing the vulnerable version while leaving the patched version unharmed. That dual requirement prevents agents from gaming the system with brute-force crashes that have nothing to do with the actual flaw. The scoring mechan...