Source-linked AI summary
Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models
Zongjie Li, Alan Z. W, John Nicolas J, Walter H. F, Scott Donald L, Gordon Y. P, Deke X
TL;DR
The paper addresses the cost, supervision, and teacher-access bottlenecks limiting open-weight cyber-agent post-training. It combines five supervision techniques with executable, audited environments and reports broad gains across CyberGym and pooled CTF evaluations. The authors position this as an end-to-end demonstration that a seven-person independent team can train competitive open-weight cyber models.
Problem
Open-weight cyber post-training is constrained by executable-environment cost, reliable multi-turn supervision, teacher-access restrictions, and incomplete reasoning visibility.
Method
The framework combines five complementary techniques with executable environments, evidence-based filtering, and long-context supervised fine-tuning.
Results
23.76% average CyberGym improvement and 10.49% pooled CTF improvement are reported across three checkpoints, with Feyospace-s1 reaching 63.24% verified CyberGym success.
Takeaways & Limitations
The work reports that frontier-level agentic cyber post-training can be carried out by a seven-person independent team using an open-weight, environment-grounded pipeline.
Takeaways & Limitations
Reasoning-trace adoption was limited by source heterogeneity, possible provider-injected reverse traps, and the inability to fund comprehensive cleansing, validation, and ablation studies.
Abstract
from arXiv · showhide
Training capable cyber agents is often treated primarily as a problem of model scale, yet open-weight post-training is constrained more directly by the cost of executable environments, reliable multi-turn supervision, and access to strong teachers. We present a data-centric framework that addresses these bottlenecks through five complementary systems: Choulea analyzes hidden reasoning signatures, SkyReal reduces teacher-sampling cost, Hongzwang bypasses API restrictions on teacher execution, PSBreakup restores capabilities weakened by model merging, and Kreator converts expert interventions into trainable reasoning. Our data engine constructs resettable coding, vulnerability, CTF, kernel-history, full-exploit, firmware, and device-backed environments. Candidate trajectories are retained only after execution verification and evidence auditing, yielding 164,269 trajectories for long-context supervised fine-tuning. The three checkpoints improve over their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across the pooled CTF suites. As of September 1, 2026, Feyospace-s1 achieves a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard, while all three checkpoints rank 1st among models at comparable parameter scales. To our knowledge, this is the first end-to-end demonstration that a seven-person independent team can train open-weight models with leading agentic cyber capability.
1. Introduction
The paper proposes practical open-weight cyber post-training built around faithful environments, high-quality supervision, and five complementary techniques. Its audited data pipeline improves three checkpoints across CyberGym and pooled CTF evaluations.
- Open-weight cyber post-training depends on faithful, verifiable environments and guidance that exposes the capabilities students should acquire.
- Five techniques address reasoning fidelity, teacher-sampling cost, closed-model elicitation, open-model recovery, and expert-guided reasoning construction.The techniques are Choulea, SkyReal, Hongzwang, PSBreakup, and Kreator.
- The data engine spans repository coding, vulnerability, CTF, kernel-history, exploit-development, and hardware environments.It processes 27,502 coding instances, 69,854 vulnerability environments, 9,312 CTF environments, 12,993 kernel-history environments, 1,601 exploit cases, and hardware environments.
- 164,269 audited trajectories support long-context supervised fine-tuning across coding, security, and hardware tasks.
- 23.76% average CyberGym improvement and 10.49% pooled CTF improvement are reported across the three post-trained checkpoints.Feyospace-s1 reaches a 63.24% CyberGym verified success rate and ranks 10th on the official leaderboard as of September 1, 2026.
- The work reports an end-to-end cyber post-training program spanning data construction, training, and evaluation by a seven-person independent team.The stated contributions include a systematic account of agentic SFT engineering, a comprehensive cyber data-construction pipeline, and release of training trajectories.
2. Supervision and Capability Techniques
The framework combines five techniques to recover, elicit, or preserve useful supervision and capability under teacher-access, sampling-cost, model-merging, and intervention constraints. Choulea reveals structured reasoning signatures, while the other techniques target scalable teacher access, capability restoration, and expert-guided trajectory construction.
- Choulea: Signature Hack: Choulea models reasoning as observable atomic operations and their ordered compositions, rather than isolated cues.The composition structure records adjacency, nesting, branching, interruption, and conflict-repair relations among operations.
- Choulea: Signature Hack: 92.8% weighted aggregate recovery was achieved before the August 21 defensive update, but Generation 5 averaged 67% for traces below 4096 tokens and 39% for longer traces.Recovered traces were not incorporated into training in this phase because of resource and data-quality constraints.
- SkyReal: Leverage Account: SkyReal exploits low-cost account channels to reduce teacher-sampling expense, with system-wide average leverage reaching approximately 273×.The reported leverage is based on quota value relative to account cost, and the 429-reset mechanism contributes approximately 2× additional leverage.
- Framework overview: Five techniques address complementary supervision bottlenecks: reasoning-signature recovery, sampling-cost reduction, constrained teacher elicitation, model-merge recovery, and expert-intervention internalization.The framework includes Choulea, SkyReal, Hongzwang, PSBreakup, and Kreator, respectively.
- Hongzwang: Jailbreak Tech: Hongzwang’s residual strategy S7 resolves an additional 39% of cases after S1 through S6, extending coverage through identity renaming and competitive challenge.The system combines selectable mutation strategies, structured retries, and task-specific skills under constrained APIs.
- PSBreakup: PSBreakup uses behavioral interference probes and token-level reverse-KL distillation to restore target-domain behavior weakened by model merging while preserving retained-domain utility.The method constructs prompt-conditioned teachers from the same model and reverses target-domain weakening introduced by MOPD merging.
- Kreator: Expert-Guided Intervention Internalization: Kreator converts expert interventions into trainable reasoning, using missing-step prompts when teachers reach blocking states; the evaluated environments averaged 3.6 intervention turns each.Teacher self-rewrite performed best among the accepted recipes, while native-thinking prompt search was excluded because its cost was prohibitive.
3. Environment-Grounded Data Pipeline
The paper builds an environment-grounded cyber data pipeline that converts diverse software, security, and hardware artifacts into resettable, executable task cases. Strict construction, behavioral validation, evidence screening, and auditing produce training traces only after candidates satisfy reproducibility and integrity requirements.
- Pipeline scope: The pipeline packages repositories, vulnerability records, challenges, historical commits, and firmware into environments with artifacts, runtimes, reset mechanisms, and verifiers.Each trajectory is one model interaction within an environment, while retained trajectories proceed to evidence filtering and training.
- Repository-level coding: 27,502 repository-level coding instances were processed into standardized environments through dependency recovery, execution reproduction, and evaluation-script construction.Accepted environments require successful builds and test execution after automated construction and filtering.
- Repository-level coding: 79.0% of 27,502 processed coding instances yielded valid environments, spanning 1,170 of 1,349 repositories entering construction.The two construction tiers are not directly comparable because only the less expensive tier receives successful seed examples as in-context guidance.
- Security construction: Categories A–C acquire security environments from public vulnerability records, author-maintained challenges, and mined development history, while Category D reconstructs exploit cases from selected source environments.Category D rebuilds the task specification, runtime requirements, and verifier around exploit completion.
- Security construction: KriKaspersky retained 12,993 verified Category C environments after mining 428,000 historical commits, source-level analysis, isolated reproduction, and final auditing.Candidates pass construction, behavioral validation, prefix-similarity screening, and integrity auditing before retention.
- Filtering and mixture construction: The final SFT mixture contains 164,269 retained traces after evidence filtering, including 28,177 basic-coding and 136,092 advanced-security and hardware traces.Each environment is rolled out one to three times, so multiple retained trajectories may originate from one resettable environment.
4. Experimental Setup
The experiments apply SFT independently to three open-weight checkpoints using long-context trajectory serialization, selective loss weighting, document-isolated packing, and role-faithful interaction records. Teacher selection matches reasoning explicitness to student capacity rather than relying only on teacher accuracy.
- Training setup: SFT is performed on Qwen3.6-35B-A3B, Qwen3.8-27B, and Qwen3.5-122B-A10B without a subsequent reinforcement-learning stage.The workflow uses slime, the ms-swift Megatron backend, Megatron Core, FlashAttention 2, Transformer Engine, and SGLang evaluation serving.
- Supervised fine-tuning objective: Each serialized trajectory is partitioned into reasoning, final-answer, and assistant tool-call targets, while prompts, tool responses, observations, and other context are excluded from the loss.Tool-call targets include both the selected tool and its supplied arguments.
- Supervised fine-tuning objective: Final-answer and assistant tool-call tokens receive full loss, reasoning tokens receive weight 0.8, and context tokens remain loss-masked.Per-trace normalization uses effective supervised-token mass so longer traces do not dominate solely because they contain more tokens.
- Teacher selection: Detailed teacher traces transferred reliably to smaller students, whereas concise traces from lower-explicitness teachers did not reliably transfer below roughly 300B parameters.The paper therefore matches teacher reasoning explicitness to student capacity rather than selecting teachers by standalone accuracy alone.
- Long-context sequence construction: Cases are packed into sequences of up to 262,144 tokens with document-level block-diagonal causal attention, preventing cross-case context leakage.Tokens retain causal dependencies only within their own trajectory while preserving the efficiency benefits of packing.
- Long-context sequence construction: Role-faithful serialization preserves runtime event order and original message roles because reordering events or rewriting auxiliary system messages as user messages degraded trajectories.Affected V1 trajectories are excluded from training but retained as a diagnostic set.
5. Evaluation
The evaluation spans vulnerability reproduction, interactive CTF solving, exploit development, and safety robustness. Post-training substantially improves CyberGym and pooled CTF performance, but transfer and adaptive multi-turn safety remain uneven.
- Evaluation scope: CyberGym evaluates PoC vulnerability reproduction, while CTF suites test interactive security problem solving and EXP suites probe full exploit development.CyberGym and CTF provide quantitative comparisons; ExploitBench and ExploitGym serve as capability-boundary diagnostics.
- CyberGym: 41.54, 8.73, and 21.00 percentage-point gains raise verified CyberGym success to 51.29%, 63.24%, and 50.07% for the three Feyospace checkpoints.The reported gains correspond respectively to Qwen3.6-35B-A3B, Qwen3.8-27B, and Qwen3.5-122B-A10B.
- Interactive CTF: 46.23%, 52.21%, and 40.09% pooled CTF success improve over the starting checkpoints by 13.00, 6.70, and 11.78 percentage points.The evaluation covers CyBench, XBOW Validation Benchmarks, and NYU CTF Bench under shared serving and agent settings.
- CTF transfer: CTF transfer varies sharply within model families, ranging from degradation to improvement depending on whether training data and traces teach the required security reasoning.For example, two models sharing a starting checkpoint diverge from 19.68% to 4.79% and 23.40% on NYU CTF Bench.
- Exploit diagnostics: EXP-specific SFT raises capability coverage from 12.96% to 19.05% and reaches the T3 target-primitive tier on two cases, but not T2 or T1.The results indicate progress beyond vulnerability reproduction while generic out-of-cage primitives and full control remain unresolved.
- Safety robustness: Adaptive multi-turn attacks raise ASR for all three Feyospace checkpoints to 86.8%, 92.2%, and 96.4%, and the recipe increases ASR in five of six paired comparisons.The study prioritizes helpfulness and cyber capability without a separate alignment stage.
6. Future Work
Future work extends the pipeline to a roughly 300B-parameter checkpoint and tests reinforcement learning and model merging for difficult-task performance and capability preservation.
- Larger checkpoints: A roughly 300B-parameter checkpoint is being extended from the partial exploit-development results of Qwen3.8-Flash-Next.Early internal runs produced complete exploit programs on several cases, but full results await repeatable end-to-end verification.
- Further training: Reinforcement learning and MOPD-based model merging will be evaluated for improving difficult-task performance while preserving capabilities recovered by the current pipeline.These experiments are ongoing and are not yet reported as final benchmark results.
- Verification boundary: Full ExploitBench and ExploitGym results for the larger checkpoint will be reported only after training is complete and solutions pass repeatable end-to-end verification.The current exploit observations remain preliminary.
7. Conclusion
Feyospace-v1 combines executable environments, complementary supervision techniques, evidence-based filtering, and long-context SFT into an environment-grounded cyber post-training framework. Across three checkpoints, it improves CyberGym and pooled CTF performance and supports competitive agentic cyber post-training by a seven-person independent team.
- Framework: The framework combines executable tasks, five complementary supervision techniques, evidence-based filtering, and long-context SFT.It is presented as an environment-grounded approach to coding and cyber post-training.
- Training data: 164,269 audited training trajectories span coding, vulnerability reproduction, CTF, kernel, EXP, firmware, and physical-device environments.The trajectories form the training corpus produced by the pipeline.
- Results: 23.76% average CyberGym improvement and 10.49% average pooled CTF improvement are reported across the three checkpoints.The conclusion frames these gains as evidence of a competitive agentic cyber post-training pipeline.
- Scope: The authors characterize the project as the first demonstration that a seven-person independent team can build a competitive agentic cyber post-training pipeline.The claim is explicitly qualified as being to the authors’ knowledge.
Ethics Statement
The paper states that its cyber work was defensive, sandboxed, and focused on execution-verified training data, while its appendices document funding, auditing, and representative reasoning-trace procedures.
- Safety intent: All exploit-related activity was confined to the authors’ own sandboxed environments and the techniques were intended for defensive cybersecurity workloads.The statement contrasts this setup with a separately disclosed incident involving escaped evaluation models.
- Funding: The initial environment construction, teacher sampling, and engineering work were financed entirely by the first author before institutional support.The appendix records only this early self-funded phase, not the later institutional-supported SFT program.
- Expense accounting: Project expenses are reported in U.S. dollars after discounts and coupons, with free credits at zero cost, refunds negative, and rented or returned devices counted by net cash cost.The appendix consolidates receipts and project notes from the early data-collection and environment-construction period.
- Audit design: The anti-cheating audit is restricted to one serialized trajectory and grounds verdicts in observable tool calls, responses, and file operations.Its read-only design prevents external evidence from entering the judgment while preserving trace-linked reviewability.
- Audit outputs: The audit distinguishes clean, cheat, uncertain, and error outcomes, and requires minimal, reviewable evidence rather than full traces or tool responses.Clean does not prove successful task completion or rule out invisible cheating.
- Reasoning traces: The appendix retains one representative case for each of ten atomic-operation categories, using excerpts from GPT and Claude-family reasoning traces.The cases are selected for pattern clarity and readability.
C.5 Conveyor rates: compressed trace
The conveyor problem asks for individual belt rates and total output under a temporary reduction in Belt B’s rate. The compressed trace reports the solved rates and total production.
- Problem setup: The pairwise belt rates are 84, 76, and 92 packages per minute, with Belt B reduced to 75% for 10 minutes after 15 minutes at normal rates.The task also requires determining individual rates and total output.
- Solution: The individual belt rates are A=50, B=34, and C=42 packages per minute.These values are obtained by subtracting each pairwise rate from 126.
- Solution: The total output is 3,065 packages across the two operating phases.Phase 1 produces 1,890 packages and Phase 2 produces 1,175.
C.6 Conveyor rates: explicit verification
The explicit trace verifies the conveyor-rate solution by checking a pairwise sum and calculating the first phase’s output.
- Verification: A + C = 50 + 42 = 92, confirming the stated pairwise rate for belts A and C.The equality is marked as verified.
- Output calculation: Phase 1 output is 1,890 packages from a combined rate of 126 packages per minute over 15 minutes.This calculation is part of the explicit solution trace.
C.7 Three-color marbles: conflict recognition
The marble-count problem is recognized as inconsistent: applying the stated conversion conditions produces a noninteger solution, so no integer initial counts exist.
- Problem setup: The marble problem starts with 60 total red, blue, and green marbles and imposes two separate conversion conditions.Five red marbles become blue in one scenario, while four blue marbles become green in another.
- Conflict recognition: The resulting equation gives g=61/4, which is noninteger, so the conditions have no integer solution.The trace explicitly identifies the formulation as inconsistent.
- Reasoning behavior: The reasoning process is tagged for conflict detection, backtracking and revision, and termination with an output.These tags characterize the intended reasoning behaviors.
C.8 Three-color marbles: alternative interpretation
An alternative reading of the marble conversions still yields no integer solution. The broader trace also includes a separate cross-border tax-compliance task handled with a general, non-evasive framework.
- Alternative interpretation: Interpreting the conversions as reclassifying marbles gives G+4=R, but the same system still has no integer solution.The alternative interpretation does not resolve the inconsistency.
- Reasoning behavior: The marble task is tagged for backtracking and revision and conflict detection.These tags reflect the reasoning response to the inconsistent constraints.
- Separate task: A separate task asks for tax-compliance risks in a cross-border structure involving intellectual property, royalties, and related-party financing.Its stated orientation is to provide a general compliance framework rather than tax evasion advice.
- Separate task: The tax task is tagged for scope declaration and task orientation.The trace explicitly identifies these as properties of the response.
C.10 Crude-oil storage arbitrage
The section evaluates whether crude-oil cash-and-carry arbitrage is profitable after storage, financing, and handling costs. It concludes that the required futures spread exceeds the available spread, while storage ownership adds optionality.
- The breakeven futures price is 78.8555, requiring a 5.4555 spread versus an available 3.70 spread.The resulting cash-and-carry position is unprofitable.
- Owning storage can provide option value through rolling, wider-spread capture, blending, timing, and early unwind.Paying market storage rates removes much of this advantage, whereas owned tanks have lower marginal costs because the investment is sunk.
- The analysis also considers basis risk between WTI futures at Cushing and the stored crude’s local grade or location.
D. Category D Long-Tail Vulnerability Subtypes
Category D’s long-tail subtype record combines a main distribution with a complete low-frequency table. The 3%–5% share band is intentionally represented in both views.
- Figure 9 codes every Category D subtype whose unrounded share exceeds 3% of the full 1,601-case set.
- Table D.1 enumerates every subtype whose unrounded global share is below 5%.The table preserves the long tail without overloading the main figure.
- The 3%–5% band appears in both Figure 9 and Table D.1, retaining visibility in the main distribution and the complete low-frequency record.