https://varas-onemind.github.io/Recent content on VARASHugoen-usWed, 16 Sep 2026 18:57:35 +0800https://varas-onemind.github.io/posts/cybergym_v2/Wed, 16 Sep 2026 18:57:35 +0800https://varas-onemind.github.io/posts/cybergym_v2/<p>CyberGym is a large, authoritative benchmark in the cybersecurity field designed by UC Berkeley, in which an agent must locate the target vulnerability, construct a PoC that triggers it, and pass differential verification.</p> <p>A month ago, we designed the VARAS-OneMind workflow, which decomposed each task into eight stages: &ldquo;locate sink points, locate source points, recover dataflow, identify control conditions, understand sanitizers, construct PoC, verify, and reflect &amp; switch paths.&rdquo; Using gpt-5.4 with a two-hour budget per task, we passed differential verification on 1116 tasks.</p>https://varas-onemind.github.io/posts/exploitgym/Fri, 11 Sep 2026 10:00:00 +0800https://varas-onemind.github.io/posts/exploitgym/<h2 id="overview">Overview</h2> <p>ExploitGym is a binary-exploitation benchmark from UC Berkeley spanning userspace programs, V8, and Linux kernel targets. Each instance comes with a description of the vulnerability and a proof that it can be triggered; the agent must turn that starting point into a working exploit that retrieves a flag from a separate target environment.</p> <p>In each instance the vulnerability and a way to trigger it are therefore given; what remains is the exploitation itself. VARAS-OneMind is an agent system built for that stage: it must turn the given reachability into an end-to-end exploitation path that reaches the objective, under a fixed time limit and without human intervention. This is where long-horizon difficulty concentrates: the space of possible chains is large, and intermediate feedback is partial and often misleading. This post describes the design principles behind VARAS-OneMind and reports its performance on two model configurations: GLM-5.3 and DeepSeek-V4.1-Flash.</p>https://varas-onemind.github.io/posts/cybergym/Fri, 14 Aug 2026 11:25:02 +0800https://varas-onemind.github.io/posts/cybergym/<p>CyberGym is a large-scale public benchmark for vulnerability analysis and reproduction proposed by UC Berkeley. It contains 1,507 real-world vulnerability tasks covering 188 widely used open-source software projects. The vulnerabilities are primarily collected from Google&rsquo;s continuous fuzzing platform OSS-Fuzz, with most tasks focusing on memory safety vulnerabilities in C/C++ projects.</p> <p>In the core Level 1 tasks, the model is provided only with the vulnerability description and the complete source repository before the patch. It must autonomously analyze the code, locate the vulnerability-triggering path, and construct a runnable PoC. The reproduction is considered successful only when the generated PoC triggers the vulnerability on the pre-patch version but fails to trigger it on the post-patch version.</p>https://varas-onemind.github.io/posts/hello/Fri, 14 Aug 2026 10:46:51 +0800https://varas-onemind.github.io/posts/hello/<p>Welcome to the VARAS research blog.</p> <p>Here we will share our research on vulnerability discovery, program analysis, fuzzing and AI security agents.</p>https://varas-onemind.github.io/projects/Fri, 14 Aug 2026 10:44:42 +0800https://varas-onemind.github.io/projects/<h1 id="projects">Projects</h1> <h2 id="varas">VARAS</h2> <p>Automated vulnerability analysis and research agent system.</p> <h2 id="cybergym-evaluation">CyberGym Evaluation</h2> <p>Evaluation of autonomous vulnerability discovery systems on CyberGym.</p>https://varas-onemind.github.io/research/Fri, 14 Aug 2026 10:43:55 +0800https://varas-onemind.github.io/research/<h1 id="research">Research</h1> <h2 id="agentic-vulnerability-discovery">Agentic Vulnerability Discovery</h2> <p>Exploring autonomous agents for vulnerability discovery and validation.</p> <h2 id="static-analysis">Static Analysis</h2> <p>Research on program analysis, data flow analysis and vulnerability detection.</p> <h2 id="fuzzing">Fuzzing</h2> <p>Automated testing and vulnerability discovery through fuzzing.</p>https://varas-onemind.github.io/about/Fri, 14 Aug 2026 10:35:37 +0800https://varas-onemind.github.io/about/<h1 id="about-varas">About VARAS</h1> <p>VARAS is a vulnerability analysis and research system focused on automated software security research.</p> <p>Our research interests include:</p> <ul> <li>Vulnerability Discovery</li> <li>Static Analysis</li> <li>Fuzzing</li> <li>AI Agents for Security</li> <li>Automated Vulnerability Reproduction</li> </ul>