Cybersecurity Agent

This project introduces a specialized evaluation framework for autonomous security agents using the CyberGym/OSS-Fuzz infrastructure. It focuses on the ability of agents to automate the discovery and verification of real-world vulnerabilities (Crashes, Memory Corruption) in C/C++ projects.

Open-source red-teaming framework for AI agent systems. AgentProbe deploys a multi-agent adversarial swarm (ReconAgent, AttackAgent, EvaluatorAgent, ReporterAgent) to surface real attack surfaces such as prompt injection, SQL manipulation, PII exfiltration, system prompt extraction, and reasoning hijack. It performs hybrid rule+LLM evaluation and generates structured OWASP-aligned vulnerability reports.

AI security agent that audits MCP skills and agent code for vulnerabilities. Detects prompt injection, tool poisoning, and credential leaks. Issues cryptographic trust certificates.

This green agent evaluates the behavior of an AI system by simulating benign but potentially sensitive usage patterns and telemetry events. It assesses how the target system detects, classifies, and responds to these scenarios, including risk scoring, policy enforcement, and response consistency. The agent focuses on end-to-end evaluation of safety handling, signal interpretation, and decision outcomes, ensuring the system operates within expected guardrails without manual intervention.

AI cybersecurity agent — Solidity exploit, root cause analysis, threat detection

VulnHunter: An AI Security Agent for Web Application Vulnerability Detection VulnHunter is an OpenEnv-compatible reinforcement learning environment that trains AI agents to detect and patch web application security vulnerabilities. The green agent evaluates coding agents on their ability to: Identify vulnerabilities - Correctly classify SQL injection, Cross-Site Scripting (XSS), and Path Traversal vulnerabilities in Python/Flask web applications Generate secure patches - Produce syntactically correct code fixes that block exploits without breaking functionality Reason about security - Explain vulnerability mechanisms and justify fix approaches The agent is scored using a hierarchical reward structure: +0.3 for correct vulnerability identification, +0.2 for valid patches, +1.0 for patches that successfully block exploits, and -0.2 for syntax errors. Maximum score is 1.5 per vulnerability. Trained using GRPO (Group Relative Policy Optimization) with Unsloth on an NVIDIA A100 GPU, VulnHunter demonstrates that smaller, specialized models (7B parameters) can achieve expert-level security analysis through targeted reinforcement learning.

Abstract This scenario evaluates agentic reasoning for end-to-end offensive vulnerability research within the CyberGym benchmark. The Green Agent assesses a participant’s ability to analyze real-world C/C++ programs derived from OSS-Fuzz targets, identify memory safety vulnerabilities, and produce deterministic proof-of-concept (PoC) inputs that trigger the underlying flaw in live binaries. Agents may iteratively refine their analysis and PoC based on execution feedback across multiple interaction turns. Evaluation emphasizes three core competencies: (1) vulnerability discovery in complex code paths, (2) exploit generation through reproducible, base64-encoded PoCs, and (3) technical reasoning via structured explanations that correctly diagnose root causes and trace exploitation paths. Scoring explicitly rewards alignment between theoretical analysis and exploit behavior, discouraging superficial crash generation and favoring agents that effectively leverage feedback-driven refinement.