How do we evaluate if a model can find and exploit security vulnerabilities? How do we know when agents become useful for defenders, and when they cross the threshold into uplifting attackers? Here, we discuss some benchmarks that measure this, from capture-the-flag exercises to data exfiltration on a 50-host network.
Before diving into the benchmarks, I think it helps to understand the common pattern they share, largely based on four primitives. (You’ll notice that it’s similar to general evals and agent environments, albeit tweaked for the cybersecurity domain.)
A sandboxed target: The vulnerable system runs within Docker containers. This might be a container with the vulnerable codebase, or a network with services, databases, and hosts.
Inputs that influence task difficulty: At the hardest level, the agent only gets the vulnerable code. This reflects a zero-day scenario where the vulnerability and patch are unknown. Easier setups may provide the vulnerability description and/or a patch, representing the one-day scenario where attackers reverse-engineer the patch to build an exploit. As additional hints, we can also include a crash trace or a proof of concept (PoC) that triggers the vulnerability.
Source: Eugene Yan — Read the full article on the original site ↗