ExploitGym Launches Benchmark for AI-Driven Exploit Development

Researchers released ExploitGym, a large-scale benchmark built from real-world software vulnerabilities to measure whether AI agents can turn disclosed flaws into working exploits. The project’s v1.0 release includes 869 instances spanning userspace programs, Google’s V8 engine, and the Linux kernel, and is positioned as a realistic test bed for exploit-generation capability rather than a synthetic coding exercise.

Project materials published through GitHub and an associated research release describe the benchmark’s operational framework, including Python dependencies, Docker-based environments, runtime artifacts, a firewall, an LLM proxy, and agent execution workflows. The repository states that ExploitGym is actively maintained, provides a canonical task list for the current release, and links the work to a 2026 paper examining whether AI agents can convert security vulnerabilities into real attacks.