GCSA Agent achieves 91.3% success rate on CyberGym benchmark

The Global Cybersecurity Alliance (GCSA) announced that the GCSA Agent achieved a 91.3% success rate on the CyberGym benchmark, placing it in the “Leading Systems Above 90%” category.

CyberGym is a real-world cybersecurity evaluation framework developed by researchers at the University of California, Berkeley. It utilizes 1,507 historical vulnerability test cases across 188 major software projects to assess the practical capabilities of AI agents. Unlike traditional benchmarks that focus on static analysis or code understanding, CyberGym requires agents to work within actual vulnerable code environments.

In Level 1 evaluations, an agent is provided with a vulnerability description and an unpatched repository. To succeed, the agent must autonomously perform code analysis, locate the vulnerability, reason about attack paths, and construct and execute a Proof-of-Concept (PoC) that triggers the flaw in the unpatched version but fails in the patched version.

Powered by Grok 4.5 and Grok 4.6 models, the GCSA Agent’s performance highlights a shift in AI cybersecurity, suggesting that ultimate security capability is increasingly determined by an agent's ability to manage complex workflows—such as hypothesis formation and iterative refinement—rather than the underlying large language model alone.