ExploitGym Benchmark

A benchmark is a fixed set of tasks that is repeatedly given in the same way in order to compare performance. ExploitGym is such a test for computer programs designed to detect flaws in other software. Such flaws are called security vulnerabilities: points at which an attacker gains more privileges than they should have. The test deliberately presents an AI system with leaky programs and observes whether it finds the vulnerabilities and actually exploits them. The whole thing runs in a sandboxed practice environment that has nothing to do with real systems on the internet. At the end there is a percentage: the share of tasks the system solved.

What a percentage reveals about offensive capability

Finding security vulnerabilities was, for decades, manual work done by highly specialized experts. When a machine takes this over, the pace changes dramatically. Defenders could have their own software scanned before anyone else does. Attackers could use the same tool for their own purposes. It is precisely this dual nature that makes measurements here so sensitive and so important.

Large AI labs now publish safety reports on their models. These reports include results from tests like ExploitGym as evidence of how dangerous a model could become. If the value rises above a predetermined threshold, stricter rules kick in. This can mean that a model is not released openly or that certain requests are blocked. Regulatory authorities are also increasingly paying attention to such numbers.

A common misconception: a high score does not mean the model can immediately bring down the power grid. The tasks are practice exercises with a known solution. Real attacks additionally require patience, access, and knowledge of the specific target. The benchmark measures a partial capability, not the whole threat.

From task container to success message

Each task consists of a small, complete computer system inside a capsule. Experts call such a sealed-off capsule a container: it behaves like its own machine but cannot touch anything outside it. Inside it runs a program with a built-in vulnerability. Also hidden within is a short string of characters, the so-called flag. Whoever reads it out has proven that they truly exploited the vulnerability.

The AI system is given a command line, meaning the text input through which one issues commands directly to a computer. It is allowed to read the program code, launch tools, and try out inputs. After each command it sees the result and plans the next step. This cycle of acting and observing repeats until the time or budget runs out. If the system submits the correct flag, the task counts as solved.

The evaluation is thus purely automatic and cannot be talked up. Either the flag is correct or it isn’t. Usually each task is run through multiple times, because AI systems respond differently to the same question. It also matters how many attempts are allowed: a system with a hundred tries will almost always score better than one with five.

Where the numbers show up

ExploitGym values are most commonly found in the technical accompanying papers of new language models. There they appear alongside results from math and coding tests. Trade media and financial news pick them up when a provider reports a significant jump. An increase from ten to forty percent counts as news because it shows how quickly this capability is developing.

The test stands in a tradition: security professionals have for years practiced with Capture-the-Flag competitions, in which exactly such hidden strings are sought. ExploitGym transfers this format to machines. Related benchmarks measure other aspects of the same topic, such as writing malware or patching vulnerabilities.

For companies, these values are practically relevant. Security firms decide, based on such tests, whether to build a model into their auditing tools. Insurers and regulators are interested in how easily attacks can be automated in the future. When reading such figures, it is therefore always worth checking the fine print: which tasks, how many attempts, which tools were allowed.