ExploitBench
A test of whether a model can go beyond spotting a software flaw and actually build a working attack.
Finding a vulnerability and exploiting one are different skills. CyberGym measures the first: can a model identify and confirm a flaw in source code. ExploitBench and its timed sibling ExploitGym measure the second: can it reason through the chain of steps that turns that flaw into something that actually works.
Scores here matter more than most benchmark numbers because they map onto real risk in both directions. The same ability that lets a model write an exploit lets defenders find decades-old bugs before someone else does, which is why labs now publish these figures alongside their coding results, and occasionally delay a release because of them.
-
We Are Building an Invention Meant to Outgrow Its Inventors
-
GLM-5.3 Got Much Better at Breaking Software, So Z.ai Is Holding the Weights Back
-
1,200 AI lab employees ask Washington for a brake pedal they admit nobody knows how to build
-
Hugging Face published the full forensic timeline of the AI agent that broke into its systems
-
OpenAI says one of its test models broke out and hacked Hugging Face