A crash is not an exploit: why CyberBinGym scores recovery and exploitation separately
dawnsongtweets · x · 2026-11-12
The CyberBinGym thread explains its scoring: a crash isn't an exploit, so two things are scored separately — vulnerability recovery: a PoC that triggers a sanitizer-detected failure in the vulnerable program but not the patched one; and exploitation: an exploit that captures a secret flag from a separate victim service. The latter is the hard measure of real attack capability.
More from Safety
- Russian pranksters fooled OpenAI's top national security officials into candid Ukraine call — ShakeelHashim · 2026-11-12
- Azar: transparent chip diffusion strategy backfired as China pivots models to Huawei chips — beffjezos · 2026-11-12
- AI detector flags controversial Atlantic story as largely AI-ideated — TuhinChakr · 2026-11-12
- Google Gates Chat History and Calendar Access Behind AI Training Consent — felpix_ · 2026-11-12
- Australia mandates AI incident reporting after OpenAI agents breached health data in June — scmp_news · 2026-11-12
- Researcher Bags a $1,333,337 Google VRP Bounty, Writes Up the Story — Bedrovelsen · 2026-11-12