Chinese AI Security Agent Sangfor AI Surpasses OpenAI and Anthropic, Ranks Top 4 Globally

On July 29, Sangfor Technologies unveiled the latest results of its AI-powered security agent, Sangfor AI, on the CyberGym benchmark, a globally recognized cybersecurity evaluation platform. Using a fixed configuration based on the domestic GLM-5.2 large language model, Sangfor AI tackled 1,507 vulnerability challenges spanning ARVO and OSS-Fuzz scenarios, successfully completing 1,301 of them for an 86.3% overall success rate.

This performance placed the agent fourth worldwide and first among all Chinese entries, surpassing security assessments submitted by OpenAI and Anthropic. CyberGym is widely regarded as one of the most rigorous real-world testing grounds for code security AI, going beyond theoretical evaluation by using historical high-risk vulnerabilities from open-source software as test cases.

The evaluation measures an AI agent's full-chain capability across autonomous source code analysis, multi-stage vulnerability reasoning, exploit reproduction, and proof-of-concept verification. Sangfor AI achieved an 87.2% success rate on ARVO tasks and 77.7% on OSS-Fuzz tasks, demonstrating consistent performance under complex code analysis scenarios.

Sangfor's technical team described the agent's architecture as an Agent Swarm with collaborative reasoning, featuring an evidence-governance mechanism. The framework operates across four core components: bounded exploration, evidence persistence, dynamic hypothesis adjudication, and adversarial candidate review.

In bounded exploration, the system launches independent, clearly scoped investigation branches for different security hypotheses, allowing multiple explanations to progress in parallel without cross-contamination. Evidence, rather than full conversation histories, is shared across investigation branches, ensuring verified findings are retained while disproven paths are not revisited.

The company has started deploying the technology in enterprise code security scenarios, evolving traditional Static Application Security Testing (SAST) into security agents with autonomous reasoning and business logic understanding. New-generation security agents can detect not only common issues like SQL injection and command execution but also complex business logic flaws such as unauthorized access and authentication bypass. Sangfor says it will continue to refine its security agent capabilities and translate benchmark-validated technology into deployable enterprise solutions.