AI writing code is nothing new.
The real difficulty lies in how to place AI in an unfamiliar and overwhelming real codebase and keep it in the role of a security researcher for ongoing investigation: analyzing the mechanics of vulnerabilities, tracking code logic, writing trigger inputs, excluding interference, and ultimately delivering a verifiable PoC.
Recently, Machine Heart saw a bright showing on the CyberGym list: In this test that included 1507 real-world vulnerability missions, Sangfor AI, which relies on a purely domestic base model (GLM-5.2), completed 1301 projects with an overall success rate of 86.3%, ranking in the top four globally in the national evaluation team.
But if it is understood only as "the domestic model takes a high score", the technical significance of this result may be underestimated. Because what is truly validated is not only the model's ability to read and understand the code, but also whether a secure Agent system can use decentralized code reasoning and tooling, and organically integrate it into an explorable, traceable, verifiable, and delivable loophole research process.
CyberGym's assessment requires AI to independently complete executable, verifiable vulnerability replication in a vast real code library. The core rules are very strict: triggering a crash is not the same as replicating a target vulnerability.
In other words, the system must establish a strict causal relationship between anomalies and designated defects. This is also the content of the list. It considers not whether AI can come up with seemingly reasonable answers, but whether it can complete a deep, evidence-based study of vulnerabilities.
Under such a requirement, Sangfor AI has completed 1301 projects with an overall success rate of 86.3%. Among these, ARVO source tasks completed 1193 projects with a success rate of 87.2% and OSS-Fuzz source tasks completed 108 projects with a success rate of 77.7%.
Under the Unified Verification Rules, a completion rate of 86.3% sends a clear signal that the security agent system underpinning the country's large-scale model is on the top of the global ladder.
However, more relevant than the ranking is the belief that the Agency is transforming its model capabilities into deployable security outcomes through a system dedicated to security research.
Are you convinced why Agent was used to scan and retrieve vulnerabilities?
It's not that "one model isn't strong enough to call several", but rather that vulnerability research itself isn't a "one-off question-and-answer" task that can be steadily undertaken.
Vulnerability recovery is essentially a continuous process of reducing uncertainty.
A brief description of a vulnerability often corresponds to a number of explanations; a seemingly hazardous piece of code that cannot be accessed from a real input; an input that triggers a crash that does not necessarily lead to a target defect.
Individual models can perform localized code analysis or generate candidate PoCs. However, in long-link explorations, the context of lengthy conversations poses obvious dangers: early misjudgments are easily solidified as the default premise, failed paths are repeatedly tested incorrectly, bulk logs overwhelm critical facts, and the generation of candidates and self-audit takes place through the same process.
To solve these problems, Sangfor AI set up a core "evidence governance" mechanism: allowing models to boldly make assumptions, but the system must be cautious in accepting conclusions.
1. Let the "hypothesis" be fully developed and let the evidence decide to leave the "hypothesis".
The value of using Agent Swarm collaboratively is that Swarm maintains multiple independent explanations of vulnerabilities, rather than allowing multiple Agents to "vote" on the same answer.
Different branches, respectively, follow loophole mechanics, code paths and trigger strategies, and strictly observe boundaries to avoid unconfirmed early judgments and evolve into collective default prerequisites. This avoids the common bias in security research.
2. Sharing the state of evidence rather than the complete history of the dialogue
Each of the investigative branches does not need to send each other long arguments to synchronize the information. They are synchronized with the "hard evidence" that can be inferred: such as the facts confirmed in the code, the actual running results, the triggering conditions of the stuck program, and which paths have been proven to be unsuccessful.
There is a particularly critical logic to this: failed attempts will never be abandoned.
For example, a field change can't cause a crash, a call path can't be reached with a real input, a certain input structure has been proven ineffective, and these seemingly unconnected "negative results" are very valuable research assets. They can directly help the system cut the wrong dead ends, narrow the search range, and avoid repeated cratering.
After all, in the familiar security research process, one explanation can be excluded, which is the result itself.
3. Dynamic Arrangement: Keeping Uncertainty Closed
Multi-Agent collaboration is definitely not the more the better, nor can it spread the computational average in all directions.
The Agent system has a continuously operating "coordination layer" that assesses in real time the state of the evidence based on dynamic evolution: which assumptions are still in place, which links are yet to be confirmed, which paths are most likely to lead to new breakthroughs, and which branches should be suspended, merged or terminated.
This means that every exploration has to be subjected to a hardness test. Does it substantially narrow the search space?
If a survey point supports continuing to generate homogeneous conclusions but cannot produce new evidence, then it makes no sense to continue to invest. A truly effective Agent sort is not to let the system "do more", but to let limited computing continue to flow the most profitable path to information.
4. The conclusions to be drawn must be separated from those to be audited
This is one of the most secure industry features of the whole set of designs. The branch-generated candidate PoCs cannot be directly adopted and must go through an independent adversarial review, undergoing rigorous three-dimensional scrutiny:
Can the collapse stabilize recovery?
Is there really a targeted vulnerability?
Is there a more reasonable explanation?
Unreviewed candidates will be withdrawn and their exposed anomalies and absence conditions will be transformed into the next round of constraints.
The mechanism extends the "default mistrust" principle in the field of security to the Agent itself: the system will not blindly trust conclusions from within, nor equate multilateral consensus with fact.
Therefore, Sangfor AI's multi-agent architecture is not a simple probability stack or role-playing, but a rigorous link from assumptions, evidence, candidates to judgments: models are responsible for providing a variety of possibilities, while Agent systems are responsible for making real security conclusions through evidence.
What's more important than the world's top four is that security AI is changing the rules of competition.
In the past, when the industry discussed AI security capabilities, the most frequently asked question was: Which model is stronger?
Now, another question is becoming equally important:
How can model capabilities be organized into stable, verifiable, auditable safety productivity?
The full use of GLM-5.2 by Sangfor AI also adds to the research value of this work. When the underlying model provides a relatively uniform code understanding and reasoning capability, the end-of-life rate depends entirely on whether the system can manage parallel assumptions, adhere to valid evidence, discontinue inefficient exploration, and rigorously eliminate candidates for lack of causal support before submission.
In a nutshell: the model determines the limits of capability, while the Agent system determines how many limits can actually be converted into results.
Currently, most multi-agent systems remain at a simple "role-sharing" stage. But in a security scenario, blindly increasing the number of Agents will not lead to higher credibility. If multiple Agents share the same false premise, fall into the same logic, and by internal voting themselves say that enlargement is often not a capability, but a mistake.
It's a very convincing choice to be closer to the technical intuition of a professional security team:
the value is not measured by quantity of output, but by whether the conclusion can be proven;
Not to replace external evidence with Agent consensus, but to build credibility against verification;
It is not about making failures disappear from the context, but transforming them into a subsequent search constraint.
Instead of pursuing answers for every branch, we are pursuing a continuous reduction in uncertainty for the whole system.
In the field of security, there is never a shortage of risk tips, and what is really scarce is a system that can answer the following questions:
Why is this vulnerability?
Where did the evidence come from?
What alternative explanations have been excluded?
Why is this PoC able to distinguish between the vulnerability version and the repair version?
The question is whether the final conclusion can be questioned by another researcher.
When AI really started getting into the study of vulnerabilities, the threshold was no longer "whether to give an answer" but "whether to prove an answer".
From this point of view, 86.3% is not just a high-scoring scorecard, it's more like a system-level verification: a large domestic model can not only handle complex code security tasks, but can also, under a rigorous Agent architecture, form an automated vulnerability research team with assumptions management, evidence deposition and independent decision-making capabilities.
In addition to the 1301 successful missions, this is the part of the industry that deserves more attention.