开源模型终于能打网络安全战了
闭源大模型在网络安全上已经很强，但开源的一直跟不上——不是模型不行，是没人把「真实漏洞」变成能训练的数据。CyberFactory 干的就是这件事：它把公开的 CVE 漏洞记录，自动转化成可执行、可验证的任务，再让老师模型像真实黑客一样去分析源码、试错、根据执行结果修正，最后把这些过程教给开源模型 Aegis。结果 Aegis 在 CyberGym 基准上达到 52.4% 的通过率，比它的底座 Qwen 3.5 提升了 22.8 个百分点，还超过了同框架下的通用模型。这不是你明天能用的工具，但它意味着：网络安全能力不再被闭源垄断，开源社区有了可复制的训练路径。
📄 原文摘要(英文)
As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention, with closed-source LLMs (e.g., Mythos) delivering advanced cybersecurity capabilities. However, existing open-source efforts remain limited: frontier open-weight models do not provide reproducible cybersecurity training solutions, open-source training solutions focus on isolated tasks and lack scalable agentic data, and scaling agentic rollouts requires strong domain priors. In this work, we introduce CyberFactory, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA). CyberFactory transforms public vulnerability artifacts, including CVEs from the wild, into executable and verifiable task instances. It further uses a reusable vulnerability-analysis skill to guide the teacher through source inspection, problem solving with domain prior, and evidence-based validation. The resulting supervision is agentic: the model interacts with tools and target environments and revises its solutions according to execution feedback. Using these trajectories, we train and release \modelname\emph{Aegis is, in Greek mythology, the protective shield of Zeus and Athena; the name reflects the model's defensive, security-oriented purpose.}, which internalizes the skill-guided procedure without requiring the skill at inference time. On CyberGym, \modelname reaches 52.4% Pass@1 under a one-hour budget, improving over its Qwen~3.5 base model by +22.8 points and outperforming the evaluated general-purpose backbones under the same scaffold.