Novee (Israeli; Ido Geffen, Gon Chalamish, Omer Ninburg) emerged from stealth Jan 14, 2026 with $51.5M (YL Ventures, Canaan, Oren Zeev). NoveeGym-RL is an SFT→RLVR pipeline on open tooling — verl + rLLM + vLLM + Axolotl, GRPO/DPPO — running 500–1,000 concurrent rollouts on one 8×B200 node against real open-source web apps (pre-warmed pools, Docker sandboxes, CDP browsers). Anti-cheat is deterministic: exploits are re-executed against the live app ("we grade execution, not claims"). From their small-models post (Jul 31, 2026): Qwen-3.5 27B went 55%→82% pass@3 on XSS, 9B 10%→56%, 4B 2%→51% — "80% of frontier's exploit rate for 15% of the cost" (~$16 vs ~$105 per 100-target run) — and fine-tunes solved four genuine zero-days. NoveeGym is NOT open-source; no weights, no gym release. Business model: commercial AI pentesting platform; zero-days feed training data. Threat: proved the economics of small-model offensive RL. Opportunity: everything they built is closed — their stack validates the design, not the market.
The Cyber Defense Benchmark (arXiv 2604.19533, Apr 2026) tested 32 LLMs across 1,418 runs: an agent hunts 26 multi-stage campaigns (105 ATT&CK procedures) in 75k–135k-log Windows telemetry with a 50-query DuckDB SQL budget. The best model (Opus 5) found only 45.1% of evidence; 0/32 passed the ">50% recall on every tactic" bar; worst was 0.087. Failure modes: exfiltration universally weakest (16–32%), agents quit early, cost-quality is "a cliff." Their qwen-3.8-27b-cybersecurity post is Simbian evaluating Alibaba's Apache-2.0 Qwen 3.8 27B (Aug 2026) — it scored 10.6% coverage (6th of 7) and "sits on the wrong side of the cost-coverage frontier"; Simbian released no model of their own. Openness: one sample environment on GitHub; full corpus free only to "credible organizations"; notably it is RLVR-ready (Gymnasium API, seeded context-morphing anti-memorization) but they haven't shipped training on it. Opportunity: the blue-side training gap is exactly their unfilled flank.
The Hub (launched Sep 2025) lists 2,500+ RL environments, prime env install-style, built on the verifiers stack; creators earn via bounties (~$100–$500 per accepted environment) plus research grants — no usage-based revenue share. Security presence is nearly nil: only chaiko/hacking-ctf verified. Opportunity: free distribution — publish a serious security environment there and we're the biggest fish in an empty pond.
Cyber-Zero (arXiv 2508.00910) synthesizes agent trajectories from CTF writeups via two-persona LLM simulation (DeepSeek-V3 generator; 30 paired turns; generate→evaluate→reformat) — no Docker, no sandbox. Cyber-Zero-32B: +13.1% absolute, then-SOTA among open weights. License CC-BY-NC-4.0; repo archived Jul 10, 2026. Sister project CTF-Dojo (arXiv 2508.18370): 658 executable challenges; training on just 486 execution-verified trajectories gave +11.6%. Implication: big-lab interest is real but non-committal — assets to fork, not to fear.
Frontier labs went all-in on offensive cyber: Anthropic's Claude Mythos Preview (Apr 2026) autonomously finds zero-days (23k potential vulns claim); OpenAI answered in June with GPT-5.5-Cyber, Codex Security, "Patch the Planet" (85.6% CyberGym). UK AISI (Jul 2026) names GLM-5.2 the most cyber-capable open-weight model, ~Opus 4.6-level — open baselines already good enough to train. Incumbents: CrowdStrike expanding AI benchmarks (Aug 2026) + CyberSOCEval with Meta; Palo Alto Cortex AgentiX = product, not evals. Seed-stage: Novee is the outlier; money otherwise flows to securing agents (NeuralTrust $20M), not training them.
Crossing {open weights, self-hosted environments, training-not-just-eval, purple/blue loops, local-fast models, weekly refresh}: Novee claims {self-hosted, training, local} but is closed, offensive-only, static tasks. Simbian claims {blue eval, refresh-ish} but gates access and trains nothing. Amazon claimed {training, synthesized data} and walked away (NC, archived). Academia claims {open, procedural, purple eval} at toy scale. Nobody claims: open weights + published training trajectories; a maintained procedural generator refreshed weekly as a product; a single red-trains-blue loop (attack agent generates telemetry, defender agent hunts it, both improve); a security environment with prime-installable distribution.
See also: [[bugcrowd-rl-environments]] · [[htb-ai-range]] · [[cyberfactory-openaegis]]