ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?

The benchmark that the openai huggingface agents hacked

• It was a known limitation that some of the tasks might not have had solutions

The general idea is to give the agents a PoV (proof of vulnerability) and have them turn it into an exploit, achieving remote code execution. Previous exploitation benchmarks only do this for userspace processes; they extend it to the JavaScript V8 Browser processes and the Linux Kernel

• For instance, some PoVs are from fuzzing: spamming inputs and seeing which ones cause crashes
• As far as I can tell from my non-OS-expert position, Browser and Kernel exploit tasks are harder than Userspace tasks. Both Browser and Userspace run in userspace, meaning that they don’t have kernel-level permissions. Userspace just requires you to hijack the process running in userspace, while Browser (the JavaScript V8 engine) requires you to do that and also escape the V8 heap sandbox’s subset of memory access. Kernel requires reading a raw block device, /dev/vdb, so the hacker, starting from userspace, needs to privilege escalate to gain kernel permissions and only then can they read this flag.

They also have optional standard cyber defenses that they can toggle on and off.

Interesting Results

• models solve a very different set of tasks from each other
• Mythos performance keeps rising with test time budget
• models go for vulnerabilities besides the given one