https://varas-onemind.github.io/posts/Recent content in Posts on VARASHugoen-usWed, 16 Sep 2026 18:57:35 +0800https://varas-onemind.github.io/posts/cybergym_v2/Wed, 16 Sep 2026 18:57:35 +0800https://varas-onemind.github.io/posts/cybergym_v2/<p>CyberGym is a large, authoritative benchmark in the cybersecurity field designed by UC Berkeley, in which an agent must locate the target vulnerability, construct a PoC that triggers it, and pass differential verification.</p> <p>A month ago, we designed the VARAS-OneMind workflow, which decomposed each task into eight stages: &ldquo;locate sink points, locate source points, recover dataflow, identify control conditions, understand sanitizers, construct PoC, verify, and reflect &amp; switch paths.&rdquo; Using gpt-5.4 with a two-hour budget per task, we passed differential verification on 1116 tasks.</p>https://varas-onemind.github.io/posts/exploitgym/Fri, 11 Sep 2026 10:00:00 +0800https://varas-onemind.github.io/posts/exploitgym/<h2 id="overview">Overview</h2> <p>ExploitGym is a binary-exploitation benchmark from UC Berkeley spanning userspace programs, V8, and Linux kernel targets. Each instance comes with a description of the vulnerability and a proof that it can be triggered; the agent must turn that starting point into a working exploit that retrieves a flag from a separate target environment.</p> <p>In each instance the vulnerability and a way to trigger it are therefore given; what remains is the exploitation itself. VARAS-OneMind is an agent system built for that stage: it must turn the given reachability into an end-to-end exploitation path that reaches the objective, under a fixed time limit and without human intervention. This is where long-horizon difficulty concentrates: the space of possible chains is large, and intermediate feedback is partial and often misleading. This post describes the design principles behind VARAS-OneMind and reports its performance on two model configurations: GLM-5.3 and DeepSeek-V4.1-Flash.</p>https://varas-onemind.github.io/posts/cybergym/Fri, 14 Aug 2026 11:25:02 +0800https://varas-onemind.github.io/posts/cybergym/<p>CyberGym is a large-scale public benchmark for vulnerability analysis and reproduction proposed by UC Berkeley. It contains 1,507 real-world vulnerability tasks covering 188 widely used open-source software projects. The vulnerabilities are primarily collected from Google&rsquo;s continuous fuzzing platform OSS-Fuzz, with most tasks focusing on memory safety vulnerabilities in C/C++ projects.</p> <p>In the core Level 1 tasks, the model is provided only with the vulnerability description and the complete source repository before the patch. It must autonomously analyze the code, locate the vulnerability-triggering path, and construct a runnable PoC. The reproduction is considered successful only when the generated PoC triggers the vulnerability on the pre-patch version but fails to trigger it on the post-patch version.</p>https://varas-onemind.github.io/posts/hello/Fri, 14 Aug 2026 10:46:51 +0800https://varas-onemind.github.io/posts/hello/<p>Welcome to the VARAS research blog.</p> <p>Here we will share our research on vulnerability discovery, program analysis, fuzzing and AI security agents.</p>