Xekrung 1.5 27B Preview explained: what's verified, what isn't

Alibaba Security AGI Lab's cybersecurity fine-tune holds the top row of CyberGym's model leaderboard. The weights are not released, the launch post does not exist, and most of what circulates traces back to one lab writeup.

Xekrung 1.5 27B Preview, written as XekRung-1.5-27B-Preview on the leaderboard, is a cybersecurity-specialized version of Alibaba's Qwen3.8-27B, and it holds the number one spot on CyberGym's model leaderboard with an 88.9% success rate. It is not something you can download. Interest in the name is outrunning the documentation, so this explainer separates what is published and checkable from what is claimed once, inferred, or unknown. Most of it checks out. The gaps are real, and they are listed at the end.

What Xekrung 1.5 27B actually is

Verified: the maker. The model comes from Alibaba Security AGI Lab, the byline on both the XekRung Technical Report (submitted to arXiv on April 30, 2026) and the lab's own CyberGym evaluation writeup. The lab sits inside Alibaba Security's VELLDEPTH research group, whose GitHub organization lists the April report as its security-LLM release. There is no other candidate creator in the record.

Verified: the base model. The lab states plainly that XekRung-1.5-27B-Preview is built on Qwen3.8-27B, the Qwen team's open-weights 27B dense multimodal model released on August 14, 2026 under Apache 2.0 with a 262,144-token context window (model page). So the 27B in the name is the base model's scale, not a new architecture.

Verified: the lineage. The first XekRung was an 8B model on Qwen3-8B, described in the April technical report: continued pre-training on 5 billion tokens of curated security text, roughly 300,000 supervised fine-tuning instances, and about 120,000 reinforcement-learning prompts split 70% security tasks and 30% general reasoning, optimized with GRPO. That 8B model posted an 81.04% unweighted average across 15 cybersecurity benchmarks against 72.01% for Qwen3-8B, and the report describes it as a non-thinking model that answers directly rather than showing intermediate reasoning.

Two things the report does not contain: any mention of a 27B variant, and any mention of the "1.5" numbering. What "1.0" was, and whether the 27B build follows the same recipe as the 8B, are not documented publicly.

Partly verified: the date. No launch blog post, product page, or model card for the 27B build exists that we could find. The earliest public anchor is the model's CyberGym submission, dated September 13, 2026. Chinese tech media picked the result up around September 28, and Pandaily wrote it up on September 29. Treat that submission date as the de facto release date; the actual build date is unknown.

How the lab says it trained it

The lab's writeup describes four stages of post-training, and the sequence is the interesting part. First, supervised fine-tuning on de-identified, filtered, security-task trajectories drawn from Alibaba's own offense, defense, vulnerability triage and incident-response work, covering the steps from understanding a vulnerability through picking a working proof of concept. Second, agentic reinforcement learning inside a general-purpose tool framework, where the model analyzes code, runs commands, and iterates on exploits. Third, rewards taken from executable outcomes: whether builds succeed, whether inputs crash the target, whether a PoC actually validates. Fourth, failed attempts are recycled into "failure cause, corrective action" training pairs, so the model learns to read engineering feedback instead of guessing.

The lab also states that its training data was benchmark-independent, with no CyberGym tasks, patches, or reference PoCs used. Label that as an unverified claim. It is a lab statement about its own data pipeline, nobody outside has audited it, and the benchmark's maintainers explicitly note that scores are submitted by the teams themselves.

The writeup attributes the entire gain to security-oriented post-training rather than task-specific agent policies. Analysis: that framing has a hole. The evaluation ran in the lab's own harness, so post-training quality and harness choices cannot be fully separated from the outside, and the leaderboard compares submissions, not controlled reruns.

What CyberGym's 88.9% actually measures

CyberGym is a UC Berkeley benchmark built from 1,507 real vulnerabilities across 188 widely used open-source projects, every one of them originally found by Google's OSS-Fuzz fuzzing campaign. In Level 1, the setting in question, a model receives a vulnerability description plus the unpatched codebase and must write a proof-of-concept input that triggers the bug on the vulnerable version and not on the patched one. The leaderboard separates single-model entries from agent systems that bolt on tools and memory; Xekrung's result sits on the model track.

The lab's evaluation setup, per its writeup: restricted-information setting, a final-submission metric, self-hosted FP8 inference at 256K context, up to 28,800 seconds and 3,000 interaction turns per task, and network access limited to an allowlist.

Analysis: eight hours of wall-clock budget per task is generous. The score answers "can this model eventually reproduce real vulnerabilities," not "how fast or how cheap." And 256K is the evaluation configuration, not a confirmed specification of the model itself; the Qwen3.8-27B base advertises 262,144 tokens, but Alibaba has not published a context-window spec for the fine-tune.

The leaderboard, caveats attached

Under the lab's own numbers, the Qwen3.8-27B base scored 54.51% in the same setting, so post-training added 34.39 percentage points, a 63.11% relative improvement. Against the field, Pandaily's September 29 snapshot has XekRung at 88.9% ahead of Google's Gemini 3.8 Flash Cyber at 86.3%, OpenAI's GPT-5.5-Cyber at 85.6%, Zhipu AI's GLM-5.3 at 84.5%, and DeepSeek-V4-Pro at 83.3%.

One discrepancy worth naming: the lab's own leaderboard table, dated September 13, lists GPT-5.5-Cyber in second place at 85.6% and does not include Gemini's 86.3% entry, which other tables date to September 10. Two published snapshots of the same board disagree. We flag it rather than resolve it.

CyberGym's maintainers attach their own warning to every row: results are submitted by individual teams, agent runs are stochastic so scores vary, and with leading systems already this close, modest score differences may not reflect meaningful capability gaps. A 2.6-point lead over Gemini is a lead, not proof of superiority. We covered the leaderboard result itself when it landed, in our earlier brief, which leans on the same lab writeup this piece does.

The lab's efficiency pitch is a separate claim: it says the 27B model is between 1/27 and 1/370 the size of comparable cyber models, which would cut the compute cost of automated vulnerability triage. Unverified: the comparison set and the cost math behind that ratio are not published.

Can you run it?

No. Hugging Face's model API returns zero repositories matching XekRung (checked October 17, 2026), Alibaba Security's GitHub organization news section lists only the April paper, and Pandaily reports that weights have not been released and Alibaba has given no timeline for outside access. The lab's leader, Huang Longtao, has said the lab's security technology will be offered more broadly, without naming a product or a date.

The base model is open, so anyone can attempt a security fine-tune of Qwen3.8-27B themselves. Reproducing this specific result is a different matter: it needs the training data and the evaluation harness, and only a partial description of those is public. Analysis: the "Preview" suffix fits. What exists is a leaderboard preview from a lab, not a release for users.

What we could not verify / open questions

• Launch date of the 27B build: unverified. Earliest anchor is the September 13, 2026 CyberGym submission; no announcement post exists.
• Native context window: unverified. The 256K figure is the lab's evaluation configuration, not a published model spec.
• Independent replication of 88.9%: none found. Leaderboard entries are self-submitted, and CyberGym itself says runs are stochastic.
• The no-benchmark-leakage claim: unaudited. A statement about Alibaba's own data pipeline that no outside party has checked.
• A technical report or model card for the 27B model: not found. The April report covers only the 8B version; we read its full text and it never mentions 27B or 1.5.
• Benchmarks beyond CyberGym for the 27B: none published that we could find.
• The 1/27 to 1/370 efficiency claim: methodology undisclosed.
• The conflicting leaderboard snapshots: unresolved.
• What we got wrong: nothing has been corrected yet, and this is a first draft. Our earlier brief on the leaderboard rests on the lab's writeup, so anything that writeup gets wrong, we inherited. This section is where a correction will land first.

Have you gone looking for XekRung weights and come up empty? Tell us in the comments.