CyberGym leaderboard
As of November 8, 2026, MiMo-V2.6-Flash (Xiaomi MiMo) leads CyberGym at 95.1%, ahead of MiMo-V2.6-Pro at 94% and DeepSeek V4.1 Flash at 88.1%. 8 systems ranked. Every score here is published by the model's own lab; each row links to the page it comes from.
What is CyberGym? CyberGym tests whether an AI agent can reproduce real software vulnerabilities: given a description of a historical bug and the unpatched code, write an input that triggers it. Made by UC Berkeley (Zhun Wang, Dawn Song and co-authors), June 2025.
Top models on CyberGym, November 2026
| # | Model | Score | Price / 1M | Context | Source |
|---|---|---|---|---|---|
| 1 | MiMo-V2.6-Flash Xiaomi MiMo | as reported | $0.14 / $0.28 | 1M | Vendor-reported Xiaomi |
| 2 | MiMo-V2.6-Pro Xiaomi MiMo | as reported | $0.435 / $0.87 | 1M | Vendor-reported Xiaomi |
| 3 | DeepSeek V4.1 Flash DeepSeek | pass@1 | $0.3 / $1.2 | 1M | Vendor-reported DeepSeek |
| 4 | GLM-5.3 Zhipu (Z.ai / GLM) | as reported | $1.4 / $4.4 | 1M | Vendor-reported Z.ai (Zhipu) |
| 5 | DeepSeek V4 Pro DeepSeek | pass@1 | $1.32 / $3.96 | 1M | Vendor-reported DeepSeek |
| 6 | MiniMax M3.1 Flash MiniMax | as reported | $0.15 / $0.6 | 1M | Vendor-reported MiniMax |
| 7 | GLM-5.2 Zhipu (Z.ai / GLM) | as reported | $1.4 / $4.4 | 1M | Vendor-reported Z.ai (Zhipu) |
| 8 | DeepSeek V4 Flash Deprecated DeepSeek | pass@1 | $0.44 / $1.32 | 1M | Vendor-reported DeepSeek |
CyberGym: score against price
Can you trust CyberGym scores?
No independent leaderboard publishes CyberGym results for these models yet, so every number on this page is the lab's own report of its own model. Labs choose the harness, the effort level and the subset they report, and they rarely publish failures. Read the setting under each score before comparing two rows.
- The benchmark has difficulty levels that give more or fewer hints; the leaderboard ranks only level 1, and scores at other levels are not comparable.
- Some submissions count an instance as solved if any of several attempts works, which inflates scores compared with single attempts.
- The leaderboard says agent runs are stochastic and results are submitted by the teams themselves.
How CyberGym works
The task
The agent gets a text description of a memory-safety vulnerability and the C or C++ codebase before the fix, and has to write a proof-of-concept input that triggers the bug.
The score
Success rate: the input must crash the vulnerable build under sanitizers and not crash the patched one.
Test set
1,507 instances from 188 software projects, as published by the authors.
Made by
UC Berkeley (Zhun Wang, Dawn Song and co-authors), first published June 2025.
Official sources
- www.cybergym.io/cybergym
- Paper: arxiv.org/abs/2506.02548
- Definition read on 2026-11-08
Sources and freshness
8 published scores from 4 sources. Each was read on its source page; the oldest reading on this page is from November 8, 2026. Prices beside each score come from our model price index and move when a vendor reprices.
- Vendor-reported DeepSeek
- Vendor-reported Xiaomi
- Vendor-reported Z.ai (Zhipu)
- Vendor-reported MiniMax
CyberGym FAQ
Answers derived from the 8 published scores on this page and the current price index.