CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild
The paper claims an open-source pipeline can turn real CVE artifacts into executable cybersecurity training tasks for agentic models.
CyberFactory covers proof-of-concept generation, vulnerability patching, and cybersecurity QA. It builds verifiable instances from public vulnerability material and uses a reusable analysis skill to guide teacher trajectories through inspection, solving, and validation. Those trajectories train Aegis, which the authors say no longer needs the guiding skill at inference time. On CyberGym, Aegis reports 52.4% Pass@1 under a one-hour budget, 22.8 points above its Qwen 3.5 base model. HF Daily Papers' note
CyberFactory covers proof-of-concept generation, vulnerability patching, and cybersecurity QA. It builds verifiable instances from public vulnerability material and uses a reusable analysis skill to guide teacher trajectories through inspection, solving, and validation. Those trajectories train Aegis, which the authors say no longer needs the guiding skill at inference time. On CyberGym, Aegis reports 52.4% Pass@1 under a one-hour budget, 22.8 points above its Qwen 3.5 base model. HF Daily Papers' note
score 6