CyberFactory Turns CVEs From the Wild Into Executable Training Tasks; Aegis Hits 52.4% Pass@1 on CyberGym, +22.8 Over Its Base
Open-source cybersecurity training has been stuck on isolated tasks with no scalable agentic data, while closed models pull ahead. CyberFactory connects data construction, trajectory synthesis and model training across proof-of-concept generation, vulnerability patching and cybersecurity QA, transforming public vulnerability artifacts including real CVEs into executable, verifiable task instances. A reusable vulnerability-analysis skill guides the teacher through source inspection and evidence-based validation, producing agentic supervision where the model interacts with tools and target environments and revises against execution feedback. The released model Aegis reaches 52.4% Pass@1 on CyberGym under a one-hour budget, up 22.8 points over its Qwen 3.5 base and ahead of evaluated general-purpose backbones under the same scaffold.
↳ Follow the thread