Glonce

CyberFactory turns CVEs into training data, lifts Qwen 3.5 by 22.8 points

securityThe Glonce editorsHugging Face🔥74Glonce rating74Impact68Novelty72Relevance95Surprise57Players42Credibility88
CyberFactory turns CVEs into training data, lifts Qwen 3.5 by 22.8 points

Researchers introduce CyberFactory, an open-source framework that connects three stages of building a cybersecurity-capable language model: data construction, trajectory synthesis, and model training. It targets three task types: proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA). The framework's starting material is public vulnerability artifacts, including CVEs pulled from the wild, which it transforms into task instances that are both executable and verifiable, meaning a candidate solution can actually be run and checked rather than judged by inspection alone. To generate training data for these tasks, CyberFactory uses a reusable vulnerability-analysis skill that guides a teacher model through source-code inspection, problem solving informed by domain knowledge, and evidence-based validation of the result. The supervision produced this way is agentic: the model doing the work interacts with tools and target environments and revises its solutions based on execution feedback, rather than producing a single static answer. Using trajectories generated through this pipeline, the authors train and release a model built on a Qwen 3.5 base. A footnote in the paper attaches the name Aegis to the released model, explaining the choice as a reference to the Greek mythological shield of Zeus and Athena, meant to reflect the model's defensive, security-oriented purpose; the plain text of the abstract does not state this name directly due to a formatting artifact in the source. On the CyberGym benchmark, the released model reaches 52.4% Pass@1 under a one-hour time budget, an improvement of 22.8 points over its Qwen 3.5 base model, and it outperforms other general-purpose backbones evaluated under the same scaffold. The paper frames the work against three gaps in existing open-source efforts: frontier open-weight models do not offer reproducible cybersecurity training pipelines, existing open-source training work focuses on isolated tasks and lacks scalable agentic data, and scaling agentic rollouts generally requires strong domain-specific priors that are hard to come by. CyberFactory is presented as addressing all three by unifying data construction, trajectory synthesis, and training in one framework. The abstract names closed-source systems, including one referred to as Mythos, as already delivering advanced cybersecurity capabilities, framing the open-source gap the paper is trying to close.

Key facts

  • CyberFactory is an open-source framework unifying data construction, trajectory synthesis, and model training for PoC generation, vulnerability patching, and cybersecurity question answering.
  • It converts public vulnerability artifacts, including CVEs from the wild, into executable and verifiable task instances rather than static Q&A data.
  • A reusable vulnerability-analysis skill guides a teacher model through source inspection, domain-informed problem solving, and evidence-based validation to produce agentic training trajectories.
  • The resulting model, built on a Qwen 3.5 base and referred to in a footnote as Aegis, reaches 52.4% Pass@1 on the CyberGym benchmark under a one-hour budget, 22.8 points above its base model.
  • The released model also outperforms other general-purpose backbones evaluated under the same scaffold, though those backbones are not named or scored in the text.

Why it matters

Cybersecurity is one of the areas where closed-source models, the text says, already show advanced capability, while open-source efforts have lagged for structural reasons: no reproducible training pipeline from frontier open-weight labs, work that targets isolated tasks instead of a scalable agentic pipeline, and the difficulty of scaling agentic rollouts without strong domain priors to guide them. CyberFactory is pitched as a single framework addressing all three gaps at once, by turning real vulnerability reports into checkable training tasks and generating agentic, tool-using supervision from them rather than static labeled examples.

Who it affects

The framework and the released model are aimed at researchers and practitioners building or evaluating AI systems for offensive and defensive security work, including automated vulnerability discovery, PoC generation, and patching, an area where verifiable, executable evaluation matters more than in most language tasks.

How to use it

The source text gives no release date, license terms, or repository location for CyberFactory or the trained model, and no description of dataset size or training compute is provided, so there is nothing here to act on beyond the benchmark result itself.

How solid is it

The headline number is Pass@1 on the CyberGym benchmark under a one-hour budget: 52.4%, a gain of 22.8 points over the Qwen 3.5 base model the released model was built from. The paper also claims it outperforms other general-purpose backbones tested under the same scaffold, but those backbones are not identified or scored in the available text, so that comparison cannot be independently checked from what is given here.

Risks and caveats

No author names or institutional affiliations appear in the available text, and no code or model repository is named, which limits independent verification of the claims. The model's name, Aegis, surfaces only through a footnote tied to an unresolved formatting macro in the abstract rather than a plain statement, and the identity and scores of the 'general-purpose backbones' it is compared against are not disclosed.