THREAT OPS › Threat News › Inside ExploitGym: How Researchers Are Measuring AI Agent Exploitation Capabilities
Inside ExploitGym: How Researchers Are Measuring AI Agent Exploitation Capabilities
<p class="wp-block-paragraph">In May, a group of researchers submitted a <a href="https://arxiv.org/abs/2605.11086">paper to arXiv with a thought-provoking title</a>: “Can AI Agents Turn Security Vulnerabilities into Real Attacks?”</p>
<p class="wp-block-paragraph">The research wasn’t theoretical: it was based on ExploitGym, an evaluation benchmark designed to test if AI agents could use known
MITRE ATT&CK techniques
- JavaScriptT1059.007
- VulnerabilitiesT1588.006
- Generative AIAML.T0016.002
Indicators of compromise
- https://arxiv.org/abs/2605.11086url
- https://rdi.berkeley.edu/blog/exploitgym/url
- https://www.cybergym.io/cybergym/url
- https://arxiv.org/pdf/2605.11086url
- https://www.cybergym.io/exploitgym/url
- https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testingurl