TLDR: PACEbench is a new framework for evaluating AI’s practical cyber-exploitation abilities, focusing on realistic vulnerability difficulty, environmental complexity, and cyber defenses. It features four scenarios (single, blended, chained, and defended vulnerabilities) and introduces PACEagent, an AI designed to emulate human penetration testers. Experiments with leading LLMs show that current models struggle with complex cyber scenarios and cannot bypass defenses, indicating they do not yet pose a generalized cyber offense threat, but the benchmark provides a crucial tool for future AI development and risk assessment.
A new research paper introduces PACEbench, a groundbreaking framework designed to rigorously evaluate the practical cyber-exploitation capabilities of Artificial Intelligence (AI) models, particularly Large Language Models (LLMs). Authored by Zicheng Liu, Lige Huang, Jie Zhang, Dongrui Liu, Yuan Tian, and Jing Shao, this work addresses the critical need for realistic assessments of AI’s potential in cyber offense, moving beyond the limitations of existing benchmarks.
Current methods for evaluating AI in cybersecurity often fall short, lacking the real-world complexity and dynamic nature of actual cyber scenarios. Many benchmarks, like traditional Capture The Flag (CTF) challenges, assume a vulnerable target, which doesn’t reflect the uncertainty and complexity attackers face in the wild. PACEbench aims to bridge this gap by simulating realistic environments with varying vulnerability difficulties, complex network setups, and active cyber defenses.
The Core Principles of PACEbench
PACEbench is built on three fundamental principles to ensure a practical and comprehensive evaluation:
- Vulnerability Difficulty: The benchmark incorporates challenges based on real-world Common Vulnerabilities and Exposures (CVEs), ranging from common flaws like SQL injection to more intricate logical errors. The difficulty is quantified by human exploitation success rates, ensuring a diverse spectrum of challenges.
- Environmental Complexity: It moves beyond single, isolated targets by simulating diverse network environments. This includes scenarios with multiple hosts, some vulnerable and some benign, requiring the AI agent to perform reconnaissance to identify actual targets.
- Cyber Defenses: A crucial aspect is the inclusion of security countermeasures, such as Web Application Firewalls (WAFs). This forces AI agents to not just exploit vulnerabilities but also to bypass active defenses, a significant step towards real-world attack simulation.
Four Scenarios for Comprehensive Testing
To cover a wide range of cyber-exploitation challenges, PACEbench features four distinct scenarios:
- A-CVE (Single CVE Exploitation): This scenario tests an agent’s ability to exploit a single, known vulnerability on one host, similar to existing benchmarks but with quantified difficulty.
- B-CVE (Blended CVEs Exploitation): Here, agents face multiple hosts, some vulnerable and some benign. This requires the AI to perform reconnaissance to distinguish between targets and non-targets.
- C-CVE (Chained CVEs Exploitation): This simulates multi-stage attacks where an agent must exploit an initial vulnerability to gain access, then pivot and move laterally through a network to compromise subsequent targets.
- D-CVE (Defended CVEs Exploitation): The most challenging scenario, where agents must exploit a vulnerability on a host protected by a production-grade WAF, requiring them to discover novel bypass techniques.
Introducing PACEagent: An AI Penetration Tester
To effectively navigate these complex challenges, the researchers also developed PACEagent, a novel AI agent designed to mimic human penetration testers. PACEagent operates through a structured, three-phase process: reconnaissance, analysis, and exploitation. This allows the agent to build a thorough understanding of the target environment before launching an attack. It’s also equipped with a Model Context Protocol (MCP) for fine-grained control over specialized cybersecurity tools.
Key Findings: Current AI Models Still Have Limits
Extensive experiments were conducted using PACEagent with seven leading LLMs, including proprietary models like Claude-3.7-Sonnet, Gemini-2.5-Flash, and GPT-5-mini, as well as open-source models. The results provide a clear picture of current AI capabilities:
- While some models show success in exploiting isolated, single-host vulnerabilities (A-CVE), their performance significantly drops in more complex, multi-host scenarios (B-CVE and C-CVE).
- Critically, no model succeeded in bypassing any security defenses in the D-CVE scenarios. This indicates that current AI models have not yet crossed the ‘safety red line’ of being able to defeat standard cybersecurity defenses autonomously.
- Claude-3.7-Sonnet achieved the highest PACEbench score, but even its performance was limited, suggesting that realistic and complex automated exploitation remains a major challenge for state-of-the-art models.
- Open-source models generally performed worse, often struggling with context window limitations that prevent them from managing the long histories required for multi-stage attacks.
The research also compared PACEagent against another framework, CAI, demonstrating that PACEagent’s structured design and integration of MCP led to significant performance gains, despite a modest increase in token consumption.
Also Read:
- Unmasking LLM Weaknesses: How Conversation Patterns Lead to Jailbreaks
- Evaluating AI Agents on Complex Scientific Research Tasks
The Dual-Use Dilemma and Future Directions
The authors highlight the significant dual-use dilemma presented by AI-driven cyber-exploitation. While current models are not yet a generalized cyber offense threat, future advancements could pose severe risks to real-world cyber infrastructures. The paper advocates for focusing research on the ethical application of these models, using them to enhance penetration testing tools not just for vulnerability discovery, but for the entire remediation lifecycle.
This work provides a robust benchmark and a clear baseline for tracking the future development of AI’s cyber-exploitation capabilities, guiding the trustworthy development of future models. You can read the full research paper here.
