Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face
Thom Wolf and Uri Rolls discuss the critical role of AI in cybersecurity, presenting a new benchmark called Masov. They argue that while frontier models excel at reconnaissance, they lack the sophisticated reasoning to exploit complex, logic-based zero-day vulnerabilities, such as a Keycloak name-versus-ID exploit. The solution, they propose, lies in high-quality, open-source AI models trained on real-world zero-day data to enable defenders to outpace attackers and build a new, AI-native security stack.
AI and the Frontier of Cybersecurity: A New Benchmark for Reasoning
Thom Wolf (Hugging Face) and Uri Rolls (Arithmetic) introduce a novel perspective on AI’s role in cybersecurity, emphasizing its potential as a vast, underexplored field for AI advancement and a crucial component of future defense strategies.
Cybersecurity as a New Frontier for AI
Thom Wolf highlights cybersecurity as an expansive and challenging domain for AI, drawing parallels to benchmarks like ARC-AGI-3. He explains that current state-of-the-art models, despite their capabilities, struggle with building and acting upon a dynamic model of the world. On generic benchmarks like ARC-AGI-3, models achieve only 1-2% success rates, indicating a fundamental limitation in understanding how actions in one part of a system affect others. The Arithmetic benchmark aims to address this gap by challenging models to understand and adapt to complex, dynamic environments.
The Role of Open-Source Models in Cyber Defense
Challenging the conventional binary view that separates closed-source models (good for cyber) from open-source models (bad for cyber), Thom argues that open-source models are integral to developing robust cybersecurity defenses. He envisions a future where open-source AI solutions are key to achieving widespread protection and balancing the attack-defense dynamic.
The Shifting Economics of Cyber Warfare
Uri Rolls details a fundamental shift in the economics of cybersecurity. Traditionally, attackers needed to find just one vulnerability, while defenders had to secure every potential entry point. However, the advent of powerful AI models like Mythos enables attackers to identify and exploit vulnerabilities across numerous targets simultaneously. This drastically changes the landscape, rendering existing defensive systems, which rely heavily on human intervention and operate at scale, unprepared for the rapid advancements in AI-driven offense.
An Optimistic Thesis: Models as the Solution
Despite the alarming trends, Rolls and Wolf present an optimistic thesis: AI models themselves are the ultimate solution. Drawing a comparison to the transformation of software development by AI, they propose that high-quality evaluations and benchmarks can empower defenders to consistently outperform attackers. They strongly advocate for open-source models as a cornerstone of this solution, fostering collaboration and enabling the development of a new, AI-native security stack capable of winning against AI-powered threats.
Masov: Arithmetic’s Benchmark for Access Control
Arithmetic introduces “Masov,” its first benchmark, which specifically targets access control vulnerabilities. This focus is strategic because access control represents the initial foothold for most attacks and consistently ranks as the number one vulnerability class on the OWASP list, underpinning a $30 billion industry. Unlike simple code bugs, these are logic-based vulnerabilities arising from inconsistencies within large, complex systems. The benchmark seeks to train models to reason deeply about these logical breaks, moving beyond mere pattern matching.
High-Quality Data from Real Zero-Days
The data for Masov is meticulously generated: human vulnerability researchers at Arithmetic discover their own zero-days in widely distributed open-source software. These real-world exploits are then encapsulated within “real live huge environments” – complex, chained applications like Keycloak, Vault, and a broker. This creates a blackbox setting where the model operates without access to the code or internet, receiving only basic tooling. Each step of the discovery and exploitation process is deterministically graded, allowing for precise measurement of a model’s progress.
Illustrative Zero-Day: Keycloak Name vs. ID Exploit
A specific example highlights the challenge: a zero-day found in Keycloak. The vulnerability stems from a logical inconsistency where one system component validates an administrator by their name, while another validates by their ID. This allows a low-privileged user to rename themselves to an administrator’s name, inheriting their privileges and escalating access to production code. While advanced models like GPT 5.5 and Opus successfully probe and reach the vulnerability check, they consistently fail to make the crucial logical leap required to rename the admin and exploit the inconsistency. This demonstrates that models can perform reconnaissance but lack the nuanced, human-like reasoning required for complex logical exploits.
Benchmark Results and the Speed Challenge
The “Bach” orchestrator runs the Masov evaluations. The benchmark is currently “incredibly hard,” with only one solve at K1 achieved by GPT 5.5, and public models showing limited success even at K5. The use of partial graders is vital for understanding how deep models can get into an exploitation chain, even without a full solve. The ultimate goal is to equip all models globally with the capability for these reasoning leaps, thereby giving defenders a lasting edge.
The Need for a New Security Stack
Wolf concludes that the only way to replace the outdated security stack is through AI models. The central challenge lies in speed: defenders must be significantly faster than attackers. This necessitates highly specialized models, potentially running on optimized hardware. He stresses that relying solely on a few proprietary labs is insufficient. Instead, a collaborative effort involving strong open-source models, post-training on specific network environments, is essential to democratize advanced defense capabilities for every organization.