CyberBinGym setup: 100 real CVEs, 53 projects, stripped binaries only

dawnsongtweets · x · 2026-11-12

The CyberBinGym thread describes the setup: tasks cover 100 real vulnerabilities across 53 open-source projects, spanning six vulnerability families and three analysis-complexity levels. Agents receive only stripped vulnerable and patched binaries — no source code, no vulnerability description, no PoC inputs — and must combine static analysis (Ghidra, Radare2), dynamic execution (GDB, Valgrind) and differential reasoning to recover and exploit each bug.

Related event: Dawn Song's Team Releases CyberBinGym: AI Can Exploit Real Vulnerabilities from Binary Patches Alone(9 posts)→

Original post →

More from Safety

• Andrew Critch: stop calling extinction risks "improvement"—RSM vs RSI matters — AndrewCritchPhD · 2026-11-12
• Any US State Could Legalize AI Safety Coordination via Parker Immunity — TinfoilTricorn · 2026-11-12
• Chicago schools block ChatGPT and Gemini as an AI song nears top of Korean charts — lmoroney · 2026-11-12
• AI Horizons Forum to gather ~1,000 AI safety leaders in SF, December 12–13 — austinc3301 · 2026-11-12
• Probes already deployed as first stage of OpenAI monitoring, discussant says — dfrsrchtwts · 2026-11-12
• Kaspersky details Black Owl APT breach of software vendor eyeing supply-chain attack — cyb3rops · 2026-11-12

Safety channel →