How Researchers Test Neural Networks' Ability to Write Real Exploits

Neural networks already write decent tests, find typical bugs, and generate boilerplate. But when it comes to practical information security, opinions diverge. Some claim that LLM agents will soon learn to hack complex systems autonomously, while others wave them off skeptically. To move from speculative debates to measurable numbers, researchers from Berkeley and other teams released the open benchmark ExploitGym.

Let's break down how this project works, why you need isolated infrastructure around neural networks, and what this repository gives security researchers and AI developers.

What Is ExploitGym

ExploitGym is a testbed with 869 real vulnerabilities of varying complexity. The sample includes not synthetic textbook exercises but actual cases: user utilities, Google V8 engine, and the Linux kernel.

The experiment is straightforward: we give an autonomous agent access to an environment and a task to get a flag through bug exploitation. The main goal of the project is to objectively measure how well modern LLMs can reproduce and automate attacker actions on real software.

The repository doesn't contain the exploits themselves, but a full-fledged harness for running them: Docker images with vulnerable environments, a job controller, a proxy for monitoring API requests to neural networks, and an isolating firewall.

How the Benchmark Architecture Works

The authors approached agent launch security with full rigor. If you give a language model a terminal and the command "write an exploit," releasing it into the open internet is a bad idea.

The system architecture consists of four components:

1. Controller. The backend that issues tasks to the agent, generates tokens, and verifies submitted flags. There are no hardcoded secrets in the repository: the controller generates salt and keys dynamically at startup.
2. LLM Proxy. A proxy layer between the agent and model APIs (OpenAI, Anthropic, and others). It logs token consumption, records reasoning steps, and tracks attempts by the agent to go beyond the task scope.
3. Squid Firewall. A container with Squid blocks uncontrolled agent access to external networks, so running hundreds of unverified scripts remains within sandbox boundaries.
4. Task containers. For each vulnerability, a separate Docker image is built with the necessary binaries, GDB debugger, and auxiliary utilities like socat and netcat.

Quick Start and Running Tests

Environment build depends on the uv package manager and Docker. For basic launch, you'll need Python 3.10+, Docker, and installed API provider keys.

First, pull dependencies and build artifacts:

# Установка зависимостей через uv
uv sync --extra proxy

# Сборка артефактов и распаковка данных
bash scripts/setup/setup_data.sh

# Проверка корректности установки
bash scripts/setup/validate.sh

Then bring up the firewall and download images for the test task sample:

# Образ файрвола
docker pull ubuntu/squid:latest

# Загрузка Docker-образов для выбранного списка задач
uv run scripts/setup/pull_images.py data/task_ids/sample.txt

After that, the pre-flight check script pre_run.py starts, which brings up the controller, firewall, and proxy. The script will output generated environment variables to the terminal that the agent will need:

export OPENAI_API_KEY="ваш-ключ"
export ANTHROPIC_API_KEY="ваш-ключ"

# Запуск инфраструктуры
uv run scripts/setup/pre_run.py data/task_ids/sample.txt

# Экспорт сгенерированных секретов контроллера
export CYBERGYM_ADMIN_KEY=...
export CYBERGYM_SERVER_SALT=...
export CYBERGYM_SERVER_FLAG_SEED=...
export CYBERGYM_SERVER_API_KEY=...

# Старт тестового агента
uv run examples/run_agent.py --help

If the agent successfully exploits the vulnerability and reads the target file, the controller counts the solution as valid.

Practical Value for Developers

The benchmark will be useful for two groups of specialists:

1. AI agent developers. If you're building a system for code writing or autonomous debugging, ExploitGym provides a tough stress test. The ability to untangle a complex kernel memory bug requires deep context from the model, debugger work, and building long chains of logical inference.
2. Cybersecurity researchers. The platform allows evaluating real risks of using LLMs in offensive scenarios without speculation. From benchmark data, you can understand which vulnerability classes neural networks already handle autonomously, and where they hopelessly get stuck in hallucinations.

Summary

ExploitGym is interesting as an example of engineering infrastructure for safe autonomous agent testing. If you're doing model benchmarking for code analysis or exploring the boundaries of LLM capabilities in systems programming, the project is definitely worth cloning and running on examples from data/task_ids/sample.txt.