Ansen Achieves 99.0% on CyberGym, Completing 1,492 Vulnerability Reproduction Tasks

NOVEMBER 2026

Ansen has achieved a 99.0% success rate on CyberGym with its AI-native security agent, GenRed (listed as Crimson on the CyberGym leaderboard and in its technical documentation), successfully completing 1,492 of 1,507 real-world vulnerability reproduction tasks. The result ranked first worldwide at the time of submission and second during the recorded period.

The achievement highlights Ansen’s investment in practical AI security engineering. GenRed uses a purpose-built multi-agent workflow to investigate vulnerabilities, develop reproducible proof-of-concept (PoC) inputs, and validate findings against execution evidence.

Why CyberGym matters

Developed by researchers at the University of California, Berkeley, CyberGym evaluates autonomous agents on 1,507 historical vulnerability reproduction tasks spanning 188 open-source software projects. Rather than relying on multiple-choice questions, tasks require agents to interpret vulnerability descriptions, inspect source code and fuzzing harnesses, and construct working PoC inputs. Final evaluation tests whether an input triggers the vulnerable build without triggering the same failure in the patched build. The benchmark provides a useful measure of agent-system capability on a demanding class of security research tasks.

The challenge security agents are built to address

AI is changing both the pace of vulnerability discovery and the demands on defenders. Growing codebases, complex dependencies and evolving attack techniques make it harder for security teams to examine every relevant path manually. Signature- or rule-based tools remain valuable for known patterns, but they can require substantial expert follow-up when a weakness depends on unusual inputs, cross-file interactions or intricate execution paths.

AI-native security agents offer a complementary approach. By inspecting code, formulating hypotheses, generating test inputs and validating observed behavior, they can take on parts of the investigative workload that have traditionally consumed specialist time. The goal is not simply to flag more potential issues: it is to help teams distinguish reproducible risks from uncertain findings and move faster from detection to evidence-backed remediation.

How Ansen’s GenRed agent works

Ansen’s public GenRed technical documentation describes a coordinated multi-agent research process. Separate agents examine the vulnerability description, affected source code and fuzzing harness from different perspectives. Their findings are combined into a dependency-aware plan, with bounded tasks assigned for investigation, candidate construction and testing.

Throughout this process, the system retains candidate files, scripts, execution logs and analysis notes so that each stage can inspect the underlying evidence. Candidate PoCs are rerun to assess repeatability; sanitizer reports and call chains help connect crashes to the claimed defect; and controlled input variations are used to challenge competing explanations. A distinct review and final-verification stage confirms the designated file is the one that was tested before a single PoC is submitted.

This evidence-driven design illustrates how Ansen approaches autonomous security testing: not as a one-shot answer from a language model, but as an iterative cycle of investigation, execution, review and verification.

From benchmark research to practical security workflows

The capabilities demonstrated in CyberGym have relevance beyond a benchmark environment. Within appropriate authorization and validation controls, automated vulnerability analysis and reproduction can support several stages of secure software development:

• Pre-commit and pre-release checks: investigating risky changes before code reaches production.
• Open-source component risk assessment: assessing whether disclosed issues may be reproducible in relevant dependencies.
• Patch verification: checking whether remediation prevents the previously observed failure.
• Security regression testing: reusing validated inputs and evidence to help detect recurring weaknesses.

The broader objective is clear: help security teams identify risks earlier, verify them faster and support more precise fixes throughout the software development lifecycle.

Ansen’s long-term commitment to AI security

The CyberGym result reinforces Ansen’s commitment to advancing AI-native cybersecurity. GenRed demonstrates the company’s work in autonomous vulnerability research, exploitability validation, and evidence-backed security testing.

For Ansen, the significance of 1,492 successfully reproduced vulnerabilities is not limited to a leaderboard position. It is evidence of progress toward security systems that combine expert methods with scalable AI automation—bringing faster, more accountable vulnerability research closer to everyday defensive operations.

About GenRed: Built for Security and Sovereignty

GenRed is Ansen's AI-native autonomous penetration testing platform, designed to deliver reliable, robust, and efficient security validation. It autonomously discovers vulnerabilities, validates real-world risks, and generates reproducible findings. With on-premises deployment, controlled execution, and auditable testing, GenRed enables organizations to maintain data sovereignty and full control over their security assessments while strengthening cyber resilience.

About Ansen

Ansen is an AI-native cybersecurity solutions provider delivering end-to-end solutions and services across AI security, AI-powered security operations, endpoint and workload protection, managed security services, and offensive security testing and assessment. With local offices and teams in the UAE, Saudi Arabia, Egypt, and Hong Kong, Ansen supports organizations across the Middle East, North Africa, Asia-Pacific, and beyond.

Learn more: https://www.ansen.ai

Technical documentation: https://github.com/ansenpent/crimson

CyberGym: https://www.cybergym.io/cybergym/