#1
XekRung-1.5-27B-Preview
Submitted by Alibaba Security (Sep 2026), fine-tuned from Qwen3.8-27B per the submitter; model-focused entry
88.9%
CyberGym Leaderboard and Benchmark Explained
CyberGym tests whether AI agents can reproduce 1,507 real vulnerabilities. How it works, why scores near 99% need care, and the CyberGym leaderboard as of October 2026.
SecurityUpdated 2026-10-30
What It Measures
CyberGym, from UC Berkeley, measures whether an AI agent can work with real vulnerabilities in large codebases. It holds 1,507 benchmark instances built from historical vulnerabilities in 188 software projects, all found by OSS-Fuzz, Google's continuous fuzzing service. The main leaderboard (Level 1) gives the agent a description of a vulnerability and the unpatched codebase, and asks it to produce a proof-of-concept input that triggers the bug.
It is one of the most cited security benchmarks of 2026, used in system cards by OpenAI, Anthropic and Google DeepMind. Defenders read it as a third-party measure of how well a model reasons about real code at the depth vulnerability work needs, which is the same depth patch validation and triage need.
How It Works
Each task is set at the commit just before the fix. The agent reads the codebase, which can run to thousands of files, writes a proof-of-concept, runs it and refines it from the execution feedback. A task counts as solved when the proof-of-concept triggers the vulnerability on the pre-patch version and stops triggering it on the patched version.
The leaderboard separates model-focused entries, where a lab reports its model under a standard agent, from agent-focused entries, where a team builds its own system (often several models, a vulnerable Docker image to test against, or a knowledge base updated during the run). Results are submitted by the teams themselves, and the site notes that runs are stochastic and that modest score differences may not reflect real capability gaps.
Current Leaders
#2
Gemini 3.8 Flash Cyber
Submitted by Google (Sep 2026)
86.3%
#3
ASL-Cyber-Flash
Submitted by Aeye Security Lab (Sep 2026), fine-tuned from DeepSeek-V4-Flash, tested against a vulnerable Docker image
85.9%
#4
GPT-5.5-Cyber
Submitted by OpenAI (Jun 2026)
85.6%
#5
GLM-5.3
Z.ai's own figure (Aug 2026); Proximal's independent run measured 82.8%, and 93.5% on its corrected task set
84.5%
Which model fits which security job: Best LLM for Cybersecurity (October 2026)
How to Interpret Scores
As of 30 October 2026, agent systems sit at the top of the leaderboard, led by Qihoo 360's TuLongFeng at 99.4%. Among model-focused entries, the top row is XekRung-1.5-27B-Preview at 88.9%, which its submitter, Alibaba Security, describes as fine-tuned from Qwen3.8-27B. Two of the top three model rows are fine-tuned versions of open models, by their submitters' descriptions. All of these are self-submitted.
The benchmark is close to saturated. Proximal ran four models in one harness (30 September 2026), found tasks the grader scored wrongly, removed 227 of the 1,507, and rescored. Kimi K3 rose from 81.9% to 95.6%, GLM-5.3 from 82.8% to 93.5%, GPT-5.6 Sol from 80.7% to 91.1%, and Claude Fable 5.1 (with Opus 5 fallback) from 81.0% to 87.8%. Proximal ran the closed models with their standard cyber guardrails switched off, so the comparison measures capability with refusals out of the picture. Note that Z.ai's own figure for GLM-5.3 on the original benchmark is 84.5%, and Proximal measured 82.8%; quote the source with the number.
The takeaway for defenders: large open-weight models are level with or ahead of the best closed models on this task, in an independent same-harness run. With scores this close to the ceiling, small differences between the top rows carry little meaning.
Related Resources
Run open models on your own security data
We deploy GLM, Kimi and Qwen models for security teams on infrastructure we manage, in your own cloud tenancy, or on-premise. Your code and telemetry stay private, and usage costs become more predictable.
Book a call