ExploitGym
#20 v Frameworky pro agentyUc Berkeley · 2× · naposledy 15. 9. 2026
ExploitGym is a Benchmark published by researchers from UC Berkeley (RDI Center) in collaboration with the Max Planck Institute for Security and Privacy, UC Santa Barbara, Arizona State University, Anthropic, OpenAI, and Google to evaluate the ability of AI agents to convert software vulnerabilities into working exploits. It includes real vulnerabilities from userspace programs, the V8 JavaScript Engine, and the Linux Kernel, packaged in containerized, reproducible environments. Agents receive a proof-of-vulnerability input and must develop an exploit with unauthorized code execution from it; Claude Code, Codex CLI, and Gemini CLI were tested as agent scaffolds, among others. The code is available as an Open Source project on GitHub (sunblaze-ucb/exploitgym) under A
Vlastnosti
| Autonomy Level | Fully autonomous agents with up to 2-hour time budget per task (scaling observed up to 6 hours), no human intervention |
| Channels | GitHub repository (open-source release), arXiv preprint, Berkeley RDI blog |
| License | Source code: Apache-2.0; bundled task data retains respective upstream licenses |
| Modalities | Text/code (source code, vulnerability description, PoV input, terminal/shell interaction) |
| Platform | Containerized Docker environments, controlled via Python/uv, controller-firewall-LLM-proxy architecture |
| Price | Free / open source (not a commercial product, no pricing listed) |
| Release Date | May 11, 2026 (arXiv v1); current benchmark release v1.0 |
| Tool/MCP Integrations | Agent CLIs: Claude Code, Codex CLI, Gemini CLI; in-container tools like GDB, socat, netcat; LLM proxy blocks remote MCP/web search by default |