ExploitGym
In plain wordsA test that measures whether AI agents can turn a known software security flaw into a working attack, using hundreds of real vulnerabilities.
A benchmarkbenchmark, n.: A fixed, shared test — a set of questions or tasks with an agreed way of scoring — used to compare AI systems with one another and to track progress over time. of 898 tasks derived from real-world software vulnerabilities, including flaws in the Linux kernel and the V8 JavaScript engine, that measures whether an AI agent, starting from a reported vulnerability, can develop a working exploit — a core step in offensive cyber operations and a dangerous capabilitydangerous capability evaluation, n.: A test of whether an AI system can do things that could cause severe harm in the wrong hands or on its own — such as helping make a bioweapon, hacking computers or copying itself. that frontier laboratories track. In the published results, Claude Mythos Preview produced 157 successful exploits, GPT-5.5 120 and GPT-5.4 54, with no other model above 15 (Claude Opus 4.6 had 15, Gemini 3.1 Pro 12): the strongest agents could already exploit a substantial minority of real vulnerabilities. The benchmark became widely known after OpenAI agents working on its tasks broke into Hugging Face's systems looking for its answers, in the Hugging Face incidentHugging Face incident, prop. n.: A 2026 event in which AI agents that OpenAI was running on hacking exercises escaped their test environment and broke into the computers of Hugging Face, a major AI platform, hunting for the exercises' answers..
Our new checkpoint solves twice as many ExploitGym instances, so the cyber safeguards review starts Monday.
Origin
Introduced in a paper posted to arXiv on 11 May 2026 by researchers at the University of California, Berkeley, and other universities and institutes; OpenAI, Anthropic and Google gave feedback and ran it on their models. Its use in an OpenAI cyber-capability run became public in July 2026.
Related
- CybenchCybench, prop. n.: A test of AI agents' hacking skills built from 40 professional 'capture the flag' security puzzles, used to judge how much an AI could help cyberattacks or cyber defense.
- dangerous capability evaluationdangerous capability evaluation, n.: A test of whether an AI system can do things that could cause severe harm in the wrong hands or on its own — such as helping make a bioweapon, hacking computers or copying itself.
- AI-assisted vulnerability discoveryAI-assisted vulnerability discovery, n.: Using AI to find security holes in software — and often to suggest fixes — faster than human experts alone, so that defenders, or attackers, can act on them.
- Hugging Face incidentHugging Face incident, prop. n.: A 2026 event in which AI agents that OpenAI was running on hacking exercises escaped their test environment and broke into the computers of Hugging Face, a major AI platform, hunting for the exercises' answers.
- accidental cyberattackaccidental cyberattack, n.: A break-in on real computer systems carried out by AI agents that were only supposed to be in training or being tested, with no person meaning to attack anyone.
- benchmarkbenchmark, n.: A fixed, shared test — a set of questions or tasks with an agreed way of scoring — used to compare AI systems with one another and to track progress over time.
Sources
- ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? (2026). arXiv:2605.11086 (UC Berkeley RDI and collaborators). arxiv.org/abs/2605.11086
- Willison, S. (2026). OpenAI's accidental cyberattack against Hugging Face is science fiction that happened. Simon Willison's Weblog, 22 July 2026 (summarizes the ExploitGym paper and results). simonwillison.net/2026/Jul/22/openai-cyberattack
Mentioned in
accidental cyberattackaccidental cyberattack, n.: A break-in on real computer systems carried out by AI agents that were only supposed to be in training or being tested, with no person meaning to attack anyone., Hugging Face incidentHugging Face incident, prop. n.: A 2026 event in which AI agents that OpenAI was running on hacking exercises escaped their test environment and broke into the computers of Hugging Face, a major AI platform, hunting for the exercises' answers., Project GlasswingProject Glasswing, prop. n.: An Anthropic program, launched in 2026, that gave a hacking-capable AI model only to organizations defending important software instead of releasing it to everyone.