Sangfor says its GLM-5.2 agent hits 86.3% on CyberGym
The Chinese security vendor reports its agent reproduced 1,301 of 1,507 vulnerabilities on CyberGym, claiming fourth place globally atop open GLM-5.2 weights.
The claim
Chinese network-security vendor Sangfor said on 29 July that its autonomous security agent scored 86.3% on CyberGym, reproducing 1,301 of the benchmark's 1,507 vulnerability tasks. The company reported 87.2% on the ARVO portion of the suite and 77.7% on the OSS-Fuzz portion, and said the result places it fourth worldwide and first among Chinese entrants, ahead of submissions associated with OpenAI and Anthropic.
CyberGym is a demanding test precisely because it does not accept descriptions of bugs: an agent must work through a real codebase and produce a working proof-of-concept input that actually triggers the target vulnerability, which makes partial credit and plausible-sounding reasoning worthless. Success rates on it have climbed steeply over the past year as agent scaffolds improved.
The detail most likely to travel is the base model. Sangfor said the agent is built on GLM-5.2, the open-weight mixture-of-experts model Zhipu released under an MIT licence, rather than on a frontier API from a US lab. That makes the system self-hostable inside customer networks — a practical requirement for security tooling that reads proprietary source code — and shifts the cost structure away from per-token frontier pricing.
The figures are vendor-reported. The public CyberGym site describes its scoring methodology but does not currently render a browsable ranked table of submissions, so the placement claim cannot be independently checked from the leaderboard alone, and Sangfor has not published agent traces.
Why it matters
Autonomous vulnerability discovery has been the fastest-moving capability in AI security this month, and it is dual-use by construction: the same loop that finds and proves a bug for a defender finds and proves it for an attacker. A commercial vendor reaching frontier-adjacent scores on open Chinese weights compresses two timelines at once — how quickly enterprises can run this capability on their own infrastructure, and how cheaply anyone else can. It also lands squarely in the Washington debate over restricting Chinese open models: this is the kind of downstream deployment those restrictions would be aimed at, and the kind that is hardest to reverse once weights are public.