Lightweight AI agents passed 71 of 90 tests against real endpoint defenses

Lightweight AI models can write programs that get test payloads running despite computer security protections. In a preprint published November 10, researchers at Huazhong University of Science and Technology and Virginia Tech report 71 passing runs out of 90 combinations of five models, six security products and three predefined payloads. DeepSeek-V4.1 Flash passed 17 of its 18 combinations.

The BypassGym benchmark moves beyond asking whether an AI can produce plausible-looking attack code. Its isolated Windows virtual machines run real security products. Researchers supply a test payload, and the agent writes and compiles the program that launches it. Checks establish whether it actually runs, communicates and survives the observation period. Agents receive supporting knowledge and test feedback, with opportunities to revise their work. They are not starting with an empty chat window and independently breaking into an unfamiliar computer.

The striking capability is the combination of writing, testing and revising, now available in relatively inexpensive models. Other cybersecurity benchmarks often focus on finding vulnerabilities or completing penetration-testing tasks. This one asks whether an agent's program can get past endpoint protections. For companies adopting coding assistants, the risk extends beyond generated text to tools that can turn a dangerous objective into working software.

The numbers have important limits. Each model, security-product and payload combination received only one run, which could include retries. A pass means the program was not blocked or terminated; alerts were excluded from the verdict. The original experiments ran September 15–29, with successful submissions replayed one to four weeks later. These results do not measure the chance that any given computer will be compromised today or establish a general ranking of security products.

The paper is not yet peer reviewed. Its authors say they disclosed the results to the affected vendors and plan to release the complete framework and experimental data after review. For ordinary users, the practical lesson is to keep multiple defenses: installed security software does not make an unfamiliar program trustworthy. Companies also need to examine AI tool permissions, program execution records and endpoint alerts together.

Independently adapted from research by Weifeng Yuan, Zifan Chen, Yucheng Zhang, Feng Dong, Peng Gao and Haoyu Wang, with technical detail condensed. The original paper is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

Original source published: arXiv, November 10, 2026, 15:31:48 Beijing time / November 10, 2026, 2:31:48 AM EST.