CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild
2026-08-24 • Cryptography and Security
Cryptography and SecurityComputation and Language
AI summaryⓘ
The authors created CyberFactory, an open-source system that helps train language models to work on cybersecurity tasks by turning real-world vulnerability data into practical problems. Their method lets models learn by interacting with tools and getting feedback, improving solutions over time. Using CyberFactory, they trained a model called Aegis that performs better on cybersecurity tests than previous models without needing extra guidance during use. This work aims to make cybersecurity AI training more open and scalable.
large language modelscybersecurityopen-sourcevulnerability patchingproof-of-concept generationagentic learningtrajectory synthesisCVEmodel trainingreproducible research
Authors
Jian Yang, Haau-Sing Li, Shawn Guo, Zixi Zhao, Yibo Tan, Jiajun Wu, Aishan Liu, Xianglong Liu, Tianyu Zheng, Bryan Dai, Chengran Yang
Abstract
As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention, with closed-source LLMs (e.g., Mythos) delivering advanced cybersecurity capabilities. However, existing open-source efforts remain limited: frontier open-weight models do not provide reproducible cybersecurity training solutions, open-source training solutions focus on isolated tasks and lack scalable agentic data, and scaling agentic rollouts requires strong domain priors. In this work, we introduce \textbf{CyberFactory}, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA). CyberFactory transforms public vulnerability artifacts, including CVEs from the wild, into executable and verifiable task instances. It further uses a reusable vulnerability-analysis skill to guide the teacher through source inspection, problem solving with domain prior, and evidence-based validation. The resulting supervision is agentic: the model interacts with tools and target environments and revises its solutions according to execution feedback. Using these trajectories, we train and release \modelname\footnote{\emph{Aegis} is, in Greek mythology, the protective shield of Zeus and Athena; the name reflects the model's defensive, security-oriented purpose.}, which internalizes the skill-guided procedure without requiring the skill at inference time. On CyberGym, \modelname reaches 52.4% Pass@1 under a one-hour budget, improving over its Qwen~3.5 base model by +22.8 points and outperforming the evaluated general-purpose backbones under the same scaffold.