CyberGym

CyberGym is a testbed for computer programs that independently search for flaws in software. It was developed in 2025 at the University of California, Berkeley. What is tested there are mainly AI systems capable of processing text and program code. The task is always the same: a large, real software project contains a security vulnerability, that is, a spot where an attacker can cause the program to crash or perform unauthorized actions. The AI system is supposed to find this spot and prove that it is really exploitable. The proof consists of an input that actually causes the program to crash. The tasks come from more than 180 open-source projects whose program code is publicly accessible.

What the testbed reveals about AI in security research

Until now, AI systems in programming were mostly measured using small, self-contained tasks. For example: write a function that sorts a list. Such tasks fit on a single screen. Real software, by contrast, consists of hundreds of thousands of lines spread across thousands of files. CyberGym measures precisely this realistic case.

The result is of interest to two sides equally. Companies and authorities hope to use AI to find vulnerabilities before criminals do. Conversely, the same tools could make the work easier for attackers. A neutral testbed shows how far these capabilities really extend already — rather than relying on manufacturers' marketing promises.

The published figures were initially sobering. The best systems tested solved only a small fraction of the tasks, depending on the measurement, under one-fifth. Along the way, however, they also discovered vulnerabilities that no one had known about before. Both together are the actual message: not yet dominant, but clearly more than a toy.

From program code to proof of crash

Each task begins with two ingredients. First, the complete program code of a project in the version in which the vulnerability was still present. Second, a brief description of the fix that was made later. From this combination, the AI system is supposed to work backward to determine where the problem lies.

The process resembles the work of a real security researcher. The system reads through the code, looks for suspicious spots, and then constructs a test input. This input is fed to the program. If it crashes at the expected spot, the task is considered solved. This check runs automatically; a human does not need to evaluate it.

The distinction from a mere guess is important. A language model can easily claim that there is a bug in line 4000. CyberGym does not accept that. Only the reproducible crash counts. This strictness makes the testbed robust, but it also accounts for the low success rates. There are additionally easier and harder variants, depending on how many hints the system receives beforehand.

CyberGym in news reports and products

The term usually comes up when a new AI model is introduced. Manufacturers then cite scores from such testbeds to demonstrate progress. CyberGym is one of several tests in the field of computer security. Anyone reading such figures should pay attention to the exact variant, since the values are not directly comparable.

The topic is practically relevant for anyone who uses software. Browsers, messaging apps, and operating systems consist largely of open-source building blocks. It is precisely such building blocks that form the tasks in CyberGym. If AI systems get better at this, vulnerabilities will disappear more quickly from the programs on one’s own phone.

A common misconception is that CyberGym is a tool for attacking. It is a measuring instrument, comparable to a crash test for cars. The crash test does not cause accidents; it recreates them in a controlled manner. Likewise, CyberGym only works with vulnerabilities that are already known and, in most cases, already fixed.