Cybench

Cybench is a collection of test tasks used to benchmark computer programs with artificial intelligence. All tasks come from the field of IT security, that is, from dealing with attacks on computers and networks. The program is given access to a sealed-off practice computer and a task, such as: Find the hidden secret string in this file. It then works alone, typing its own commands and checking whether it is making progress. In the end, all that counts is whether the sought-after string was found. This produces a hard, verifiable score rather than a matter of taste. Cybench was developed at Stanford University and released in 2024.

Why hacking tasks specifically are measured

Most tests for AI systems consist of questions with a single fixed correct answer. Such tests say little about whether a system can work independently over many steps. Security tasks are different: they require planning, tool use, and patience over dozens of intermediate steps. It is precisely this ability that research is currently most interested in.

There is also a political reason. Governments and companies want to know at what point an AI could become dangerous. A system that autonomously exploits security vulnerabilities would be a tool for criminals. Cybench provides a number by which this development can be tracked.

Large AI labs such as OpenAI or Anthropic test their new models for such capabilities before release. Cybench is one of the tests used for this purpose. If the score rises sharply, that is a warning sign for regulators and security teams.

Structure of the tasks and difficulty levels

The tasks come from so-called Capture-the-Flag competitions. These are contests in which teams must break into deliberately insecure software. Whoever succeeds finds a hidden string, called the flag. Cybench uses 40 such tasks from four well-known competitions.

Each task runs in its own sealed-off container, that is, an isolated mini-environment on a server. From there, the AI cannot break out into the real internet. It is allowed to operate a command line, view files, launch programs, and write code. A log records every single command so that one can later trace where the system failed.

The breakdown into sub-steps is particularly helpful. Difficult tasks are additionally broken down into smaller intermediate goals that are scored individually. This provides information even when a model fails to solve the full task. The time a human team needed to complete it serves as a measure of difficulty: it ranges from a few minutes to about a day.

Cybench in model reports and safety debates

Anyone reading the technical reports on new AI models will regularly come across Cybench. There it states what percentage of tasks a model solved. Such figures also appear in news articles about AI safety. Importantly: a high score does not mean that a model could attack real corporate networks.

A common misconception is equating practice with a real-world scenario. Competition tasks are deliberately designed to be solvable and contain clear hints. A real target system has no flag and no guarantee that a vulnerability even exists. Cybench thus measures a precursor stage, not a finished attack capability.

Nevertheless, the test is changing the debate. Security firms use similar setups to evaluate AI assistants for their own red teams. And authorities in the United Kingdom and the United States use comparable test suites for their model evaluations. Cybench thus stands as a representative example of a trend: AI is increasingly being evaluated on actions, no longer just on answers.