ExploitGym: AI Agents’ Exploitation Capabilities and Boundaries in Controlled Environments
ExploitGym tests AI agents’ ability to turn 898 real vulnerabilities into attacks. With defenses disabled, Claude Mythos Preview and GPT-5.5 achieved 157 and 120 successes respectively, but success rates dropped sharply after protections such as ASLR were enabled. This article examines its mechanisms, boundaries, and risk-management principles.