ExploitGym: A Benchmark for AI-Driven Exploit Development

ExploitGym is an open-source benchmark suite that measures how well AI agents can autonomously develop exploits for real-world vulnerabilities. It spans userspace applications, Google's V8 JavaScript engine, and the Linux kernel, with the current v1.0 release covering 869 task instances under an Apache-2.0 license.

The project ships with a full evaluation harness — a controller, network firewall, and LLM proxy — that sandboxes agent runs inside per-task-family Docker containers, disables system defenses like ASLR where needed, and enforces outbound network isolation. Setup relies on Python's uv tool, prebuilt runtime components (GDB, socat, node), and per-task Docker images.

For engineers, ExploitGym provides a reproducible way to gauge how close current AI agents are to autonomously weaponizing security bugs, with direct implications for both offensive security automation and defensive risk assessment.