{
  "video": {
    "id": "O-CBZ3JtRvo",
    "title": "Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face",
    "duration": 1048,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": "In person"
  },
  "analysis": {
    "video_id": "O-CBZ3JtRvo",
    "title": "Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face",
    "one_liner": "Arithmetic and Hugging Face are releasing a black-box access-control cyber benchmark built from zero-days the team found themselves, where today's frontier models — GPT 5.5, Opus — almost never make the logical leap to exploitation, because the argument is that only much more capable open-source models can flip cyber economics back toward defenders.",
    "summary": "Thom Wolf frames cybersecurity as a far wider AI playing field than people assume, and puts Arithmetic's new benchmark in the same family as ARC-AGI-3: tasks where the model must build a dynamic world model on the fly and act on it, not pattern-match. Uri Rolls argues the economics of cyber are shifting — attackers with models can now pick many targets at once, while defenders run at scale with almost no human intervention and are therefore bound by what models can do out of the box — so the defense has to be the models themselves. The benchmark ('Masov') focuses narrowly on access control, uses real zero-days Arithmetic found in widely distributed open-source software, hides the code from the model, and grades every step of the discovery-and-exploitation chain deterministically. Results so far: one solve at k=1, and models reliably complete the discovery phase but never make the leap to the actual exploitation.",
    "key_points": [
      "Wolf compares the benchmark to ARC-AGI-3, where current models get a 1–2% success rate, because both require the model to build a dynamic model of the world and understand how its actions change state — not just find bugs in code.",
      "Attack/defense economics are inverting: defenders must close every door and window, an attacker needs one seam, and a skilled attacker with a model can now choose many targets at once; defensive systems run at scale with very limited human intervention, so they are bound by out-of-the-box model capability.",
      "One benchmark can't capture all of cyber — 'a bit like saying that swimming, an F1 driver, and a basketball player is the same thing' — so the first release targets access control only: the number one item on the OWASP list and a ~$30 billion industry, and a class of logic-based rather than code-bug vulnerabilities.",
      "Data is human-created first, by vulnerability researchers on the team who find their own zero-days in widely distributed open-source software, then chain multiple applications into large live environments; the model gets no internet and no codebase, only basic tooling, so it must reason black-box over a surface where the zero-day is genuinely unknown.",
      "Grading is deterministic at every step of the discovery and exploitation chain (plus a binary pass: did the underprivileged user do something it wasn't allowed to?), which is what makes partial credit visible — 'how deep it got within the chain'. Eval structure diagram credited to Eugene at Anthropic.",
      "Worked example: a Keycloak → Vault → broker chain where a real, maintainer-submitted zero-day checks admin status by name in one place and by ID in another, letting a low-privileged user rename the real admin, inherit the privilege and escalate — a ~16-step logic chain.",
      "GPT 5.5 and Opus both probe chaotically, jump between components and even reach the vulnerable check, but never make the logical leap to changing the admin's name; across environments, models capture nearly all the discovery-phase information and still fail the exploitation leap. On task 'fall time' a model reasoned for over three hours without solving.",
      "Live demo of 'Bach', Arithmetic's internal orchestrator that runs the eval: currently one solve at k=1, and at k=5 GPT remains the only solver.",
      "Both speakers argue open-source models are a required part of the defense — the closed-good/open-bad framing is wrong, the real constraint is speed (catching an attacker as they enter), which points to specialized models on specialized hardware that every company can run, rather than depending on two companies to solve it for everyone."
    ],
    "takeaways": [
      "Stop treating cyber evals as one benchmark; scope them to a single capability (access control here) and build the environment so the model reasons black-box, with no code and no internet access.",
      "Build deterministic, per-step graders across the whole discovery-and-exploitation chain, not just a final pass/fail — on tasks this hard, partial credit is the only signal you get about where capability actually stops.",
      "Generate benchmark data from zero-days your own team finds, so it is genuinely out of distribution and not memorized; humans doing the search is the current bottleneck and the point.",
      "Read the traces. Uri's day is going through what the models did, why, and how, to name specific failure modes — the useful finding here (discovery succeeds, the exploitation leap fails) only shows up that way.",
      "If you want defenders to win, invest in post-training open-source models per network and per environment for cyber, and optimize for inference speed — not just capability — since the attacker/defender race is a speed race."
    ],
    "topics": [
      "cybersecurity",
      "evals",
      "benchmarks",
      "agents",
      "open-source-models",
      "data-quality",
      "post-training",
      "world-models"
    ],
    "tools": [
      "Arithmetic",
      "Hugging Face",
      "Masov",
      "Bach",
      "ARC-AGI-3",
      "GPT 5.5",
      "Opus",
      "Keycloak",
      "Vault",
      "Anthropic",
      "OWASP",
      "mythos"
    ],
    "quotes": [
      {
        "text": "my job is to block every door and close every window and make sure that there's no way in. And the attacker's job is to find at least one seam, one crack, one thing I missed.",
        "at": "04:02",
        "url": "https://www.youtube.com/watch?v=O-CBZ3JtRvo&t=242s"
      },
      {
        "text": "our first fundamental idea is that we can't capture all of cyber in one singular benchmark. That's a bit like saying that swimming, an F1 driver, and a basketball player is the same thing. It doesn't work.",
        "at": "07:18",
        "url": "https://www.youtube.com/watch?v=O-CBZ3JtRvo&t=438s"
      },
      {
        "text": "now we're going to do something that I've been told to never do, which is show a live demo of a real system on stage.",
        "at": "12:04",
        "url": "https://www.youtube.com/watch?v=O-CBZ3JtRvo&t=724s"
      },
      {
        "text": "The only way to replace the old stack is through the models.",
        "at": "14:43",
        "url": "https://www.youtube.com/watch?v=O-CBZ3JtRvo&t=883s"
      }
    ],
    "words": 4046
  },
  "summary_url": "/#O-CBZ3JtRvo",
  "transcript": {
    "html": "/transcripts/O-CBZ3JtRvo.html",
    "txt": "/transcripts/O-CBZ3JtRvo.txt",
    "vtt": "/transcripts/O-CBZ3JtRvo.vtt"
  }
}