Research map / Multi-agent systems and games / LLM agents
BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces BountyBench, a framework and benchmark of 25 real-world systems and 40 bug bounties that evaluates AI agents on offensive (Detect, Exploit) and defensive (Patch) cybersecurity tasks with dollar-value metrics.
Problem
Existing cybersecurity benchmarks are mostly CTF or isolated snippet tasks, focus on offense only, and lack real-world, evolving systems with localized evaluation and economic impact measures.
Approach
Model real-world systems as commit-level snapshots with runtimes, invariants, vulnerabilities, exploits, and patches, and define Detect, Exploit, and Patch tasks tied to real bug bounty dollar awards. A new Detect Indicator checks whether an exploit succeeds on the vulnerable snapshot and fails on its patched version, giving localized evaluation; information levels (No Info, CWE, CWE+title, full r
Key results
- Codex CLI: o3-high achieves 12.5% on Detect (mapping to $3,720) and 90% on Patch (mapping to $14,152).
- C-Agent Claude 3.7 Sonnet Thinking reaches 67.5% on Exploit, the highest exploit score.
- Codex CLI agents patch at 87.5-90% but exploit at 32.5-47.5%, showing an offense-defense imbalance.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Provide more vulnerability information, progressing from No Info/CWE to the full report | BountyBench agents · Detect-to-Exploit information levels | success rate | Helped |
| Use coding-agent tools for code reading, writing, and modification | OpenAI Codex CLI and Claude Code · BountyBench Patch versus Exploit | success rate: 90.0%, 90.0%, and 87.5% Patch; 47.5%, 32.5%, and 57.5% Exploit | Mixed |
| Use a custom agent rather than a coding CLI agent | BountyBench agents · Exploit | success rate: 17.5-67.5% | Mixed |
Surprising findings
- Codex CLI: o3-high and o4-mini refused cyber tasks at 14.1% and 11.2% rates, versus almost no refusals for the custom agents.
- Detection remains very hard: the best Detect success rate is only 12.5%.
Limitations
- Benchmark is limited to vulnerabilities already added to each system; new bounties must be added manually.
- Human-written invariants and exploits make evaluators imperfect, so agent patches may break code or not fully fix vulnerabilities.
- Only terminal and coding agents evaluated; browser use and custom tools not explored.
Experimental setup
Datasets: 25 open-source GitHub repositories with public bug bounty reports (huntr, HackerOne)
Benchmarks: BountyBench
Metrics: success rate bounty total (dollar value) token cost economic impact
Baselines: Cybench agent CVE-Bench AutoPatchBench SWE-bench
Builds on: Cybench SWE-bench
Closest papers by meaning
- Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models (ICLR 2025 · similarity 0.88)
- CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale (ICLR 2026 · similarity 0.87)
- CVE-Bench: A Benchmark for AI Agents’ Ability to Exploit Real-World Web Application Vulnerabilities (ICML 2025 · similarity 0.86)
- CyberGym-E2E: Scalable Real-World Benchmark for AI Agents' End-to-End Cybersecurity Capabilities (ICML 2026 · similarity 0.85)
- EVMbench: Evaluating AI Agents on Smart Contract Security (ICML 2026 · similarity 0.85)
- Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.