LATIDIA · Ciberseguridad

CyberBinGym: ¿Pueden los agentes de IA convertir los parches binarios en exploits reales?

arXiv: 2611.10723v1Announce Type: new Resumen: Las correcciones de seguridad generalmente llegan a los usuarios como actualizaciones compiladas, pero los retrasos en la implementación dejan expuestos los sistemas sin parches. Durante esta ventana, comparar binarios parcheados y no parcheados

La noticia

arXiv:2611.10723v1 Announce Type: new Abstract: Security fixes usually reach users as compiled updates, but deployment delays leave unpatched systems exposed. During this window, comparing patched and unpatched binaries can reveal how to exploit a vulnerability, turning a defensive update into actionable information for attackers. Existing benchmarks do not measure this capability: they expose source code, rely on human-crafted challenges, or evaluate binary comprehension without requiring exploitation. We introduce CyberBinGym, a benchmark containing 100 tasks derived from real vulnerabilities in 53 widely used projects, spanning six vulnerability families and three levels of analysis complexity. Agents receive stripped vulnerable and patched binaries without source code or vulnerability information, and must combine static