Submersion AI Debuts Basin, Outperforming Frontier Cybersecurity Models to Claim Top-10 Global Ranking on CyberGym
New specialized AI model delivers top-tier cyber reasoning at a fraction of the cost, uncovering high-severity
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
- New cybersecurity model Basin outperforms models like Grok 4.7 and Opus 4.8 at a fraction of the deployment size and cost; achieving an 80.8% score on the CyberGym benchmark, and ranking 8th globally.
- Basin uncovered and validated high-severity zero-day vulnerabilities in enterprise software, including CVE-2026-86733 (Snipe-IT) and CVE-2026-82450 (BookStack).
- Basin leverages advanced cyber reasoning architecture, and operates entirely within customer infrastructure (on-premises, private cloud, or air-gapped), addressing hosted AI policy constraints while safeguarding sensitive target data.
NEW YORK, Sept. 24, 2026 (GLOBE NEWSWIRE) — U.S.-based company Submersion AI today launched Basin, a specialized cybersecurity model that ranks in the top 10 on CyberGym, the recognized benchmark for AI vulnerability discovery; placing it alongside models from OpenAI, Anthropic, DeepSeek, Zhipu, and xAI at a fraction of their size and cost. Basin has been used to discover and validate previously unknown, high- and moderate-risk vulnerabilities in widely used software, several of which are now publicly assigned and credited to the Submersion.ai Security Research Team.
High-capability AI models are positioned to transform cybersecurity, but various limitations have kept them out of reach for most security professionals. Leading hosted AI models restrict security-testing workflows under their usage policies, and can’t be deployed where the most sensitive systems live. At the same time, the tools to strip safety controls off open models are widely circulated. Submersion AI designed Basin to give defenders capability on par with what well-resourced attackers already have.
The Basin Cyber Reasoning Engine
Basin is the inaugural security model powered by Submersion AI’s proprietary cyber reasoning infrastructure. Built by experts that have spent decades defending the government and enterprise, Basin is designed for rapid improvement. It leverages advanced pre-training and post-training supported by custom data pipelines that enable Submersion AI to train the model efficiently and turn each cycle into a measurable gain in performance. Features include:
- Data Sovereignty-Aware Deployment – Deploys fully within a customer-controlled environment (on-prem, private cloud, or air-gapped) when data cannot leave it. Basin is also available as a hosted API for teams without those constraints.
- Autonomous Exploitation & Validation – Operates within authorized parameters to conduct reconnaissance, probe applications, and validate true exploitability – chaining findings into evidence-backed, low-noise reports optimized for human analyst review.
- Dynamic Testing – Interacts directly with running systems across production validation, pre-release testing, supply chain audits, and technical diligence.
Benchmark and Real-World Performance
In its CyberGym benchmark, Basin achieved a score of 80.8%. This places Submersion AI in 8th place on the leaderboard at launch, surpassing Grok 4.7 at 80.3% and Opus 4.8 at 78.8%, and approaching Mythos at 83.2%. Basin is also up to 90% more cost effective than similarly performing models.
Basin has already discovered and validated previously unknown vulnerabilities in widely used software, including:
- Snipe-IT before 8.7.0 (CVE-2026-86733), a high-severity vulnerability in which an authenticated superadministrator could upload a malicious ZIP backup and trigger a restore, resulting in remote code execution with the permissions of the web application user.
- BookStack before 26.05.4 (CVE-2026-82450), a high-severity vulnerability in which BookStack allows authorized users to achieve unauthenticated remote code execution by uploading a portable ZIP import containing a PHP polyglot file as a book cover, which bypasses extension validation and executes in the public web root.
To request access to Basin, visit https://submersion.ai/.
About Submersion AI
Submersion AI builds the core infrastructure required for advanced cyber reasoning. Through specialized training environments, evaluation harnesses, and synthetic data-generation methods, Submersion AI builds capable, deployable security models; starting with its flagship model, Basin. Founded by offensive security, national security, and vulnerability research practitioners, Submersion AI enables frontier-grade cyber defense and research. Learn more at submersion.ai.
Media Contact:
Jessica MacGregor
jessica@bonsaicomms.com
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/c8093c50-3afb-4ba4-9abf-5e8e1464ee95
