CyberFactory
How it works
The pipeline runs in three stages. (1) Data construction: public vulnerability artifacts from ARVO, OSS-Fuzz and from-the-wild CVEs are turned into executable instances with pre-patch and post-patch builds. (2) Trajectory synthesis: a reusable vulnerability-analysis skill guides tool-interactive agent workflows, increasing the throughput of successful training instances. (3) Model training: the synthesized trajectories are used for full-parameter supervised fine-tuning (SFT). PoC verification relies on a differential oracle 𝒱(x) = ⊤[Crash(b⁻,x)] ∧ ⊤[¬Crash(b⁺,x)]: a candidate input must trigger a crash in the pre-patch build (b⁻) while leaving the patched build (b⁺) unaffected, providing an objective, machine-checkable success signal. The resulting OpenAegis model was initialized from Qwen 3.5-397B-A17B and trained with full-parameter SFT for three epochs on 256 GPUs in BF16.
Problem solved
Open-weight models do not provide reproducible cybersecurity training solutions; existing training sets focus on isolated tasks and lack scalable agentic data, and scaling agentic rollouts requires strong domain priors. CyberFactory offers a unified, verifiable and scalable way to generate such data and trajectories.
Components
Transforms public vulnerability artifacts (ARVO, OSS-Fuzz, from-the-wild CVEs) into executable, verifiable task instances with pre-patch and post-patch builds.
A reusable vulnerability-analysis skill guides tool-interactive agent workflows, increasing the throughput of successful training instances.
Synthesized trajectories are used for full-parameter supervised fine-tuning (SFT) of the cybersecurity model (OpenAegis).
A machine-checkable success criterion 𝒱(x) = ⊤[Crash(b⁻,x)] ∧ ⊤[¬Crash(b⁺,x)]: an input must crash the pre-patch build and not crash the patched build.
Implementation
Evolution
arXiv:2608.23181 introduces a unified open-source framework for scaling cybersecurity data and trajectories; the trained OpenAegis reaches 58.1% Pass@1 on CyberGym.