Intel / article

Patterns for Building Cybersecurity Evals

Source: Eugene Yan
Author: Eugene Yan
Date: Published Jun 21, 2026

Terms in this piece · Glossary

sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.

Why it matters

Patterns for building security — targets, difficulty inputs, tools and graders — transferable to any -eval .

Key quotes

“Because exploitation is open-ended, most benchmarks evaluate outcomes instead of the method used. For C/C++ memory bugs, success means triggering a sanitizer crash. For unauthorized code execution, success requires retrieving a hidden flag string that’s only accessible via a successful exploit.”
Eugene Yan

“In unguided mode, Claude 3.5 Sonnet performed best with a 17.5% success rate, followed by GPT-4o at 12.5%. In subtask mode, o1-preview did best and completed 46.8% of the milestones. Nonetheless, all agents hit a ceiling and could not solve tasks with FST above 11 minutes.”
Eugene Yan

“The authors also analyzed why the agents failed. The most common cause was insufficient exploration, which led to 67.5% - 80% of zero-day failures (37.5% - 55% in one-day settings).”
Eugene Yan

“Claude Mythos led the evaluation by exploiting 157 out of 898 instances. GPT-5.5 followed with 120 exploits, while GPT-5.4 achieved 54. All remaining models solved 15 or fewer tasks. When given an extended six-hour window, Claude Mythos increased the exploit count to 204 while Opus 4.6 plateaued within the first 30 minutes.”
Eugene Yan

“On the previous best system (ExpertPromptShell), Claude Sonnet 4 captured critical assets in just 3 out of 40 networks. With Incalmo, that number jumped to 37 out of 40 networks, including the 50-host Equifax replica. The experiments showed that the system framework matters far more than the underlying model.”
Eugene Yan

Read the source ↗eugeneyan.com