Sangfor’s GLM-5.2 security agent solves 1,301 of 1,507 real vulnerability tasks
机器之心 · wechat · 2026-07-29
Sangfor’s security agent system, built on GLM-5.2, solved 1,301 of 1,507 real-world vulnerability tasks on CyberGym for an 86.3% success rate, placing it among the top four globally and first among domestic teams.
The article argues the real breakthrough is not the score itself, but the workflow:
- Multiple hypotheses first: separate agent branches keep alternative bug explanations alive instead of voting on one answer.
- Evidence, not chat history: branches share verified facts, runtime results, trigger conditions, and eliminated paths.
- Dynamic orchestration: a coordination layer keeps compute flowing toward the most informative branch and stops dead ends.
- Separate generation and review: candidate PoCs are adversarially checked before being accepted.
The system is presented as a validation that security work can be turned into a reproducible, evidence-driven agent pipeline rather than a one-shot coding task.
More from coding & agent
- As models improve, agent skills feel less necessary — jarrodwatts · 2026-07-29
- GPT-5.6 Pro impresses as a code reviewer and bug hunter, says one user — dejavucoder · 2026-07-29
- A model found the root cause of a bug before its developer did — giffmana · 2026-07-29
- DBHub shows how it upgraded to MCP 2026-07-28 with stateless core and header routing — rokk07 · 2026-07-29
- DBHub Adopts the New MCP Spec: Stateless Core and Caching Practices — db-master · 2026-07-29
- Kimi K3 reportedly works well in Kimi Code and Claude Code via the Responses API — zainhas · 2026-07-29