What happened
Trend Micro says its TrendAI agentic exploit-remediation engine, code-named AESIR, scored 97% on the CyberGym benchmark and ranked first on the leaderboard as of August 2026. The company says the system produced approximately 1,460 byte-level proofs across 188 open-source projects and 1,507 known vulnerabilities.
A Trend Micro security blog post dated Aug. 26, 2026 says its TrendAI agentic exploit-remediation engine, code-named AESIR, achieved a 97% score on CyberGym. The company describes CyberGym as a University of California, Berkeley benchmark containing 1,507 confirmed vulnerabilities from 188 large open-source projects. The tasks require producing a specific file or byte sequence that crashes a vulnerable program but not its patched counterpart, without access to the patch or fixed binary during solving.
According to the source, AESIR’s result represents about 1,460 individually verified differential crashes. Trend Micro says the system was evaluated over 60 development rounds, consumed about 235 CPU-hours and incurred roughly $6,000 in AI application-programming-interface fees. The company presents the result as fully autonomous and says no human was in the loop for the benchmark submissions. These figures are claims in the company’s own account; the source does not provide an independent audit or a complete submission log.
The system is described as a graduated pipeline. It first tries classical fuzzing, seed mutation and deterministic construction methods, then escalates to AI-guided agents when those approaches fail. Trend Micro says roughly 30% of its proofs used no large language model calls, while fuzzing outperformed extended AI reasoning on about one-quarter of tasks. The company says a successful non-AI run could take about 60 seconds, compared with roughly 18 minutes and $6 in API costs for an AI-agent attempt.
Trend Micro attributes the remaining performance to an internal vulnerability ontology containing more than 12,500 episodic memories and more than 15,500 exploit seeds across more than 180 projects. The ontology is described as an operational knowledge layer linking vulnerability classes, binary formats, crash types and mutation strategies. AESIR reportedly uses seven models from Anthropic, Google, OpenAI and DeepSeek in different roles, including source-code reasoning, binary-format construction and protocol analysis. The source does not disclose enough implementation detail to establish how much each component contributed to the final score.
Read the source: edge.prnewswire.com ↗
Why it matters
The result, if independently reproducible, would suggest that system design—including persistent vulnerability knowledge, multiple models, deterministic fuzzing and adversarial review—can matter more than using a single leading model. It also illustrates both the potential and limits of AI-assisted vulnerability research.
The central implication is about architecture, not simply model rankings. Trend Micro says the leading systems on CyberGym use many of the same frontier models, while their scores differ because of routing, memory, tool use and validation. Its comparison lists AESIR at 97%, Sangfor AI at 93.2%, Fudan University’s Whitzard at 91.2%, Microsoft’s MDASH at 91% and Wiz Atlas at 90.9%. It lists GPT-5.6 Sol at 84.5% and Claude Mythos 5 at 83.8%. Those standings are presented by Trend Micro as the state of the leaderboard and should be treated as source-reported until confirmed by the benchmark operator.
For security teams, the practical lesson is to reserve expensive model calls for cases that cheaper, more predictable tools cannot solve. Fuzzers and format-specific generators can handle some vulnerability classes quickly, while language models may help with source-code analysis, control-flow reasoning and multi-step exploit construction. A routing layer can also reduce dependence on one provider. But the claimed economics are specific to Trend Micro’s system, workload and private knowledge base; they should not be generalized into a universal cost estimate.
The source also emphasizes cross-model adversarial review. In AESIR’s described design, one model proposes an exploit hypothesis, another model from a different provider attempts to refute it and a third adjudicates. Roles rotate across rounds. The intended benefit is reducing false positives, such as apparent bugs that are unreachable, blocked by input validation or outside the stated threat model. This is a potentially useful pattern for AI security tooling, although the source does not provide false-positive rates, missed-vulnerability rates or a controlled comparison against single-model review.
The benchmark matters because it tests a concrete artifact rather than a conversational answer: a byte-level input that behaves differently on vulnerable and patched software. That is a stronger task than merely generating a plausible vulnerability description. Even so, a differential crash in a controlled benchmark is not equivalent to a reliable real-world exploit. It does not establish that an attacker can reach the vulnerable code remotely, bypass defenses, gain useful access or operate at scale. The result therefore speaks to exploit-construction capability under benchmark conditions, not to overall cyber risk or autonomous offensive readiness.
What to watch next
The key questions are whether CyberGym or independent researchers confirm the score, whether the evaluation can be reproduced, and how much of the result depends on Trend Micro’s private vulnerability corpus. The benchmark also does not show that the system finds active attacks, works across unknown software or can safely operate without human review.
First, independent confirmation is essential. The source says CyberGym has an official leaderboard and an independent submission system, but it does not include a direct benchmark record, reproducible code, the submitted proof set or a detailed protocol for checking the company’s score. Confirmation should establish the exact version of the benchmark, task inclusion rules, hardware and time limits, model versions, tool access and whether all systems were evaluated under comparable conditions.
Second, researchers should examine the private-data advantage. Trend Micro says its ontology incorporates more than two decades of vulnerability research associated with Trend Micro Research and the Zero Day Initiative, including thousands of exploit seeds and engagement outcomes. That accumulated operational knowledge may be valuable, but it also makes the result difficult to compare with a system using only public information. The important unknown is whether AESIR’s method transfers to new projects, vulnerability classes and software formats absent from its historical corpus.
Third, deployment claims require separate evidence. The blog discusses a threat-hunting component that can examine honeypot captures and identify possible exploitation of AI infrastructure, but that work is not the same as the CyberGym score. The benchmark does not measure whether AESIR detects active campaigns, distinguishes malicious activity from benign testing or evaluates whether a shipped fix removed real-world risk. Those questions would require operational data, disclosure of evaluation methods and careful safeguards.
Finally, security teams should watch how the system handles uncertainty and human control. Trend Micro says the hardest remaining tasks involve precise FFmpeg decoding sequences, Ghostscript state machines and smartcard ASN.1 structures. It also warns that multi-model systems can suffer from quota exhaustion, silent provider failures, cost overruns and hidden per-model regressions. Before such systems are used in production, teams need independent logging, per-component metrics, controlled permissions, human review for exploitation decisions and evidence that adversarial checks reduce harmful false positives without suppressing genuine findings.
