What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Realistic cyber ranges test whether an AI agent can sustain an entire operation across an emulated network: discovering systems, finding and exploiting weaknesses, establishing a foothold, moving between hosts and completing a stated objective. That is a harder and more useful question than whether a model can answer a security question or solve one isolated exploit.
What a realistic cyber range measures
A cyber range is an emulated environment containing hosts, services, applications, credentials, vulnerabilities and network relationships that resemble a defined operational setting. In a long-form exercise, the agent receives an objective rather than a single scripted puzzle. It must decide what to inspect, choose actions, interpret the results, recover from failed attempts and chain heterogeneous capabilities until it reaches—or fails to reach—the objective.
As an Amazon Associate I earn from qualifying purchases.
OpenAI describes this kind of exercise as measuring “a model’s ability to conduct fully end-to-end cyber operations in a realistic, emulated network.” The UK AI Security Institute (AISI) uses a similar idea: purpose-built ranges force models to chain capabilities over long action sequences. The important measurement is therefore sustained progress through a scenario, not a model’s performance on one exploit, one command or one written answer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why point tests miss important failures
An agent can know that a vulnerability exists yet fail to locate the vulnerable service, select a usable payload, authenticate to the next host or maintain a workable plan after the environment responds unexpectedly. A static benchmark often awards credit for the final answer or a single successful exploit. A range can record where the chain broke, how much context the agent retained, whether it wasted its budget and whether an apparently successful action produced any durable progress.
This makes ranges especially relevant to questions such as whether a frontier model can conduct a multi-step intrusion, how much supervision it needs and which capabilities degrade first as a scenario becomes longer or more realistic. They remain controlled experiments, not replicas of every enterprise or industrial site.
What determines whether two range results are comparable
A headline pass rate has meaning only alongside the conditions that produced it. Before comparing models, record the following dimensions:
- Scenario and network scope: the number and type of applications, hosts, trust relationships and attack paths.
- Stage measured: exposed-web exploitation, initial access, privilege escalation, lateral movement, data access, persistence or an end-to-end objective.
- Environmental realism: the services, operating systems, credentials, misconfigurations, monitoring and defensive controls represented.
- Agent harness: tool access, orchestration, memory, retry logic, execution environment and verification.
- Prompt and hints: whether the model receives an abstract goal, vulnerability clues, concrete commands or other information.
- Inference budget: token, time, tool-call or monetary limits, and whether extra test-time reasoning is allowed.
- Trial protocol and scoring: the number of runs, pass threshold, partial-credit rules and treatment of failed or incomplete steps.
- Reproducibility: whether targets, configurations, traces and scoring code are available to other evaluators.
A result under generous hints and a large inference budget can answer a useful question about assisted performance, but it should not be presented as autonomous capability. Conversely, a low score on a highly constrained harness may reflect missing tools or an unsuitable prompt as much as a model’s underlying weakness.
AgentCyberRange: an open, multi-range test bed
The 2026 AgentCyberRange paper describes an open infrastructure designed to separate different portions of an operation. It contains 110 vulnerabilities across 15 real web applications and eight enterprise-like ranges with 156 internal hosts. That combination lets evaluators examine both the exposed perimeter and what happens after an agent obtains an initial foothold.
Two distinct task families
Web exploitation asks an agent to explore an exposed application and validate vulnerabilities. It tests reconnaissance, understanding of application behavior and the ability to produce a verified exploit result.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Post-exploitation starts with a foothold and asks the agent to pursue broader compromise inside an enterprise-like environment. The work can involve host discovery, credential use, privilege escalation and movement across internal systems. A model may therefore perform well on a web task yet fail when the problem becomes a distributed, stateful sequence.
What CAGE contributes
The project’s CAGE system handles model configuration, agent launch, target deployment, model-call trace collection, run resumption, result verification and failure inspection. Those functions matter because a range is difficult to evaluate reliably if every researcher assembles a different launcher, resets targets differently or decides success by manually reading logs. Standardized execution and verification make failures more diagnosable and comparisons less dependent on ad hoc procedure.
Reported model results
In the paper’s matched-prompt and matched-budget setup, GPT-5.5 with Codex solved 16.1% of web-exploitation tasks and 31.7% of post-exploitation tasks. When the agent received more concrete hints, the reported rates rose to 33.0% and 46.3%, respectively.
These figures are study-specific rates, not a universal ranking of cyber models. They combine a particular task mix, harness, prompt, hint policy, budget and scoring method. The paper also reports findings outside its original benchmark, including unknown vulnerabilities in popular projects and payload mutation that bypassed host defenses. Such observations are signals for further controlled testing, not evidence that an agent can reliably compromise arbitrary public systems.
AISI results: progress on corporate networks, weakness in industrial control
The UK AI Security Institute evaluated seven models released from August 2024 through February 2026 in two purpose-built environments. One represented a 32-step corporate-network attack. The other represented a seven-step industrial-control-system (ICS) attack. Keeping those tracks separate exposes a key fact: progress is uneven across domains.
Corporate-network sequence
At a 10-million-token budget, average completed steps increased from 1.7 for GPT-4o, released in August 2024, to 9.8 for Opus 4.6, released in February 2026. The best single corporate-range run completed 22 of 32 steps. AISI estimated that this represented roughly six of the 14 hours a human expert would need for the same scenario.
Those numbers show that agents can now sustain substantially longer chains in at least one controlled corporate setting. They do not show that an agent will complete a comparable intrusion against every organization. The range’s topology, vulnerabilities, tools, defenses and scoring define exactly what the model learned to navigate.
Inference-time compute changes the result
AISI reports performance gains of up to 59% when inference-time compute increased from 10 million to 100 million tokens, with no observed plateau within that tested interval. More budget can let an agent investigate alternatives, recover from dead ends and maintain a longer plan. It also increases cost and latency, so a result obtained with 100 million tokens is not directly comparable with one obtained under a 10-million-token limit.
Industrial-control sequence
On the seven-step ICS environment, the newest models averaged only 1.2 to 1.4 completed steps, with a maximum of three. The contrast with the corporate track is the most important finding: a model’s apparent progress on familiar enterprise workflows does not transfer automatically to operational technology. Industrial systems can use different protocols, timing assumptions, interfaces and safety constraints, and a short step count can still represent difficult domain-specific decisions.
What the GPT-5.3-Codex system-card figures do—and do not—say
OpenAI’s GPT-5.3-Codex system-card page reports combined cyber-range pass rates of 60% for GPT-5.1-Codex-Max, 53.33% for GPT-5.2-Codex and 80% for GPT-5.3-Codex in its listed evaluation. These percentages apply to OpenAI’s own scenarios, trial protocol and scoring rule. They are not pass rates for all cyber tasks, all real incidents or all hardened networks.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
The system card identifies two especially important limitations. First, the cyber-range benchmark is internally developed. Second, the evaluated challenges did not yet represent hardened targets with the defenses and monitoring that could disrupt an operation. The card therefore says that strong results across its evaluations are necessary but not sufficient to classify a model as having high cyber capability. That qualification belongs next to the percentages, not in a footnote separated from them.
Why adjacent benchmarks should not be merged with range scores
Several prominent evaluations measure useful but different abilities. Treating them as interchangeable inflates what any one result means.
| Benchmark or family | Primary question | Reported scope | What it does not establish |
|---|---|---|---|
| AgentCyberRange | Can an agent exploit exposed applications and continue from a foothold through enterprise-like ranges? | 110 vulnerabilities, 15 web applications, eight ranges and 156 internal hosts | General success against arbitrary hardened networks |
| AISI purpose-built ranges | How far can an agent progress through a defined corporate or ICS attack sequence? | 32 corporate steps and seven ICS steps | Transfer from corporate systems to industrial control or real incidents |
| CTI-REALM | Can an agent interpret cyber-threat intelligence and construct detection rules? | Analyst workflow involving reports, data queries, schemas and rule generation | Autonomous multi-host offensive operations |
| CyberGym | Can an agent perform vulnerability analysis on real-world software cases? | 1,507 instances based on vulnerabilities from 188 software projects | A multi-host network campaign with lateral movement |
| CAIBench | How do agents perform across several cybersecurity task categories? | More than 10,000 instances spanning five categories | A single, uniform measure of end-to-end cyber capability |
CTI-REALM is centered on defensive analyst work: reading reports, querying data, understanding schemas and producing detection rules. CyberGym’s 1,507 instances across 188 software projects focus on vulnerability analysis at scale. Neither should be relabeled as an autonomous range.
CAIBench integrates Jeopardy-style capture-the-flag tasks, attack-and-defense CTFs, cyber-range exercises, knowledge benchmarks and privacy assessments. In its reported tests, state-of-the-art systems achieved roughly 70% on security-knowledge metrics, 20–40% on multi-step attack-and-defense scenarios and 22% on robotics-focused targets. Matching the scaffolding and model choice improved attack-and-defense CTF results by up to 2.6 times. The spread across categories reinforces that “cyber performance” is not one number.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to read a cyber-range result responsibly
- Identify the unit of success. Check whether the paper reports a completed step, a verified vulnerability, a whole scenario or a combined pass rate.
- Read the environment description. Note the host count, application types, operating technology, attack-path length and defensive controls.
- Separate assistance from autonomy. Record prompts, vulnerability hints, tool wrappers, human interventions and reset behavior.
- Normalize the budget. Compare token, time and tool-call limits before comparing percentages.
- Inspect partial progress. Average steps, best runs and failure locations often reveal more than a binary pass.
- Check replication. Prefer targets, configurations, traces and scoring procedures that another team can run and audit.
- Limit the conclusion. State exactly which environment the result covers and avoid extending it to all real systems.
What realistic ranges still leave out
Even a detailed emulation cannot capture every feature of production security. The OpenAI system-card caveat about hardened targets is significant: monitoring, segmentation, alert response, rate limits, deception, changing credentials and human defenders can interrupt an attack chain. A range may also simplify business impact, safety consequences and the cost of noisy actions.
Range results are therefore best treated as evidence about capability under specified conditions. Repeated trials can show whether a model’s progress is reliable or driven by a lucky path, but they cannot prove behavior against every software stack or defensive team. A benchmark that publishes traces and reset procedures can improve confidence without eliminating that boundary.
Safe use for researchers and security teams
Hands-on evaluation should remain inside isolated, disposable targets. The AgentCyberRange project’s responsible-use guidance says participants should test only systems they own or have explicit permission to test, using controlled environments. That means deploying the range in a segregated network, removing routes to production and the public internet where practical, using synthetic credentials and destroying targets after a run.
- Define authorization and the exact target boundary before launching an agent.
- Use disposable snapshots so a failed exploit or destructive command cannot persist.
- Log model prompts, tool calls, outputs, resets and scoring decisions for review.
- Prevent real secrets, customer data and production credentials from entering the environment.
- Stop a run if it attempts to leave the authorized network or affects an unintended service.
These controls make the evaluation safer and make its findings easier to reproduce. They also keep a benchmark from becoming an uncontrolled exercise against public systems.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat the evidence supports
Realistic cyber ranges are becoming more valuable because they expose the coordination problem at the center of AI-enabled security work. Recent results show meaningful progress on some corporate-network sequences, especially when models receive more inference-time compute, while performance remains much weaker on the evaluated industrial-control sequence. Open infrastructure such as AgentCyberRange can make execution and failure analysis more reproducible, and broader suites such as CAIBench can show how sharply results vary by task.
No single pass rate or model ranking should be used as a general measure of real-world cyber capability. The defensible conclusion is narrower and more useful: under a stated environment, harness, prompt, budget and scoring rule, a model completed a measured amount of work. Comparing those conditions—and examining where the chain failed—is what turns a cyber-range number into evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
