Summary
Training smart computer programs to solve cybersecurity challenges is usually seen as needing very large models, but the main limits are actually the cost of running practice environments and getting good feedback. The authors built a system that includes tools to analyze how the models think, reduce training cost, work around software limits, fix weaknesses from combining models, and turn expert corrections into learning signals. They used specialized environments for coding and hacking exercises, carefully verifying each training example, and created a large dataset to improve model skills. Their models performed better than similar-sized ones on standard cybersecurity tests and ranked highly on leaderboards. This work shows that a small independent team can successfully train open-source cybersecurity models with strong abilities.
cyber agentsmodel trainingmulti-turn supervisionteacher executionenvironment simulationfine-tuningcybersecurity challengesopen-weight modelscapture the flag (CTF)agentic models
Authors
Zongjie Li, Alan Z. W, John Nicolas J, Walter H. F, Scott Donald L, Gordon Y. P, Deke X
Abstract
Training capable cyber agents is often treated primarily as a problem of model scale, yet open-weight post-training is constrained more directly by the cost of executable environments, reliable multi-turn supervision, and access to strong teachers. We present a data-centric framework that addresses these bottlenecks through five complementary systems: Choulea analyzes hidden reasoning signatures, SkyReal reduces teacher-sampling cost, Hongzwang bypasses API restrictions on teacher execution, PSBreakup restores capabilities weakened by model merging, and Kreator converts expert interventions into trainable reasoning. Our data engine constructs resettable coding, vulnerability, CTF, kernel-history, full-exploit, firmware, and device-backed environments. Candidate trajectories are retained only after execution verification and evidence auditing, yielding 164,269 trajectories for long-context supervised fine-tuning. The three checkpoints improve over their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across the pooled CTF suites. As of September 1, 2026, Feyospace-s1 achieves a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard, while all three checkpoints rank 1st among models at comparable parameter scales. To our knowledge, this is the first end-to-end demonstration that a seven-person independent team can train open-weight models with leading agentic cyber capability.