Cybersecurity gives AI a broad testing ground because models must understand changing systems and act on that understanding.
2
Arithmetic trains on real zero-day vulnerabilities placed inside blackbox environments, with deterministic grading for each discovery and exploitation step.
3
The speakers argue that fast, capable open source models are needed to help defenders respond at the speed of automated attacks.
Summary
Uri Rolls and Thom Wolf present Arithmetic's first cybersecurity benchmark, focused on access-control failures. The benchmark puts models inside realistic blackbox environments built from chained applications such as Keycloak, Vault, and a broker. Models start with limited permissions and must discover how to reach a protected target without seeing the source code or using the internet. The vulnerabilities come from real zero days found by human researchers, and every stage of the task has a deterministic grader. One example requires noticing that one check validates an administrator by name while another validates the administrator by ID. A model can reach the relevant code path yet miss the rename-based privilege escalation. Rolls and Wolf connect this problem to models' difficulty building a working model of a changing world. They argue that cybersecurity needs strong open source models, shared training data, and specialized systems that can detect and respond faster than attackers.
Cybersecurity gives AI a wider field for exploration than many people expect
Thom Wolf says cybersecurity is a broad playing field for AI because models must explore systems rather than answer isolated questions. He compares Arithmetic's benchmark with ARC-AGI-3, where a model must understand a changing game state, predict what a click will affect, and change the state deliberately. Models reportedly achieve only one to two percent on that generic benchmark. Wolf's point is that current systems can be very capable while still failing to build a dynamic model of what is happening. Arithmetic's tasks demand the same kind of understanding inside a live technical environment, where actions change permissions, services, and later choices.
The economics of cyber offense are shifting toward many targets at once
Uri Rolls describes the old cybersecurity model as a house with every door and window needing protection, while an attacker only needs to find one crack. For roughly 20 years, attackers had to choose targets carefully, while defenders spread limited human attention across the whole stack. Models are changing that balance because they can find many primitives and zero-day exploits and can help a skilled attacker select many targets at once. Defensive systems also have to work at scale, so they have little room for human intervention. Rolls says defenders are therefore increasingly limited by what models can do out of the box.
The speakers think models themselves must become part of the defense
Rolls rejects the idea that the answer is simply to isolate systems or wait for a small number of closed models to solve cybersecurity. He argues that the same pattern seen in coding could apply here: better evaluations, better data, and better benchmarks can produce much more capable systems. Arithmetic's aim is to build models that can outperform attackers at the reasoning needed for cyber defense. Wolf adds that open source models allow collaboration and can be post-trained for particular networks and environments. Their view is optimistic, although they describe the current attack-defense shift as frightening.
Arithmetic starts with access control because privilege is the first door into a target
The first Arithmetic benchmark focuses on access control rather than trying to cover all of cybersecurity at once. Rolls describes it as the first door an attacker faces when trying to get a foothold and reach something privileged. The failures are often logical rather than simple coding bugs. Large systems can contain separate checks that make different assumptions, creating a path through the combined system that no single component appears to allow. The model must find those mismatches and reason about what the system permits. Rolls says access control is the top vulnerability class on the OWASP list and has produced a large security industry.
Human researchers create the benchmark data by finding real zero days
Arithmetic's researchers search widely distributed open source software for their own zero-day vulnerabilities. They then build large environments in which several applications are chained together. The model operates in a blackbox setting without access to the source code or the internet, although it receives the basic tools needed to complete the task. A task begins from a real vulnerability that the researchers found and submitted for verification to maintainers. A deterministic grader checks whether the model achieved the forbidden action, while partial graders record how far it got through discovery and exploitation. This lets the team inspect specific failures instead of recording only success or failure.
The Keycloak example requires a logical jump that probing models miss
One task links Keycloak, Vault, and a broker. The model starts as a low-privileged user and must reach production code. The flaw is split across two checks: one validates the administrator by name, while another validates the administrator by ID. A user can rename themselves to the real administrator and inherit that privilege. GPT 5.5 and Opus probe many parts of the system and even reach the relevant check, but they do not make the jump of changing the administrator's own name to bypass permissioning. Rolls says the model must track how each action changes the system, then write precise exploitation code. Reconnaissance alone does not solve the task.
The benchmark measures partial progress because full solutions are still rare
During the live demonstration, Rolls shows Arithmetic's internal orchestrator and benchmark results. He says the benchmark has only one solve at K1, while at K5 only GPT and the public models have solved it. The partial graders show which parts of an exploitation chain a model can complete. In one environment, GPT 5.5 is the only model that makes a particular capability leap. Other models collect nearly all the information needed during discovery but fail when they must turn that information into an exploit. Rolls also shows a run that continues working for more than three hours without solving the task, then explains that the team studies the traces to identify each failure mode.
Defenders will need fast specialized open source models
Wolf says the next steps are to produce better data, build benchmarks, fine-tune models, and learn how to protect systems against these attacks. He calls speed the main challenge because defenders must notice an intrusion and respond while the attacker is still inside. A specialized model running on specialized hardware may be needed. Wolf warns against relying on two large companies to solve the problem for everyone. Rolls says replacing the old stack requires a range of strong open source models and collaboration, with post-training for different networks and environments. They invite researchers to work on access control and other cybersecurity fields.
"The reason is the current model even though they're really good, they can't really build a dynamic model of what's happening in the world or what's happening in any type of world."01:58
Who should watch
You are building cyber agents and need evaluations that test reasoning across several services instead of source-code pattern matching.
Your security team is deciding whether open source models can be trained for defensive work across private networks and environments.
You want to understand why a model can perform extensive reconnaissance yet still miss a simple privilege-escalation logic flaw.
