updated: 2026-11-02
🏭 Cyber Factory
Mission: regularly post-train the greatest open cyber models around — red (bug bounty web2/web3, pentest, appsec) + blue (SOC, CTI, devsecops) — via an environment fleet + verified-trajectory factory + weekly refresh loop, on Qwen-class bases, shipped as fast local GGUF/MLX builds.
Doctrine (validated by 6 advisor + 4 competitor-dossier agents, 2026-11-02):
- The moat is the fleet + verifiers + refresh loop, not scraped corpora.
- Agent-native build: task queue + unbounded fan-out; repo = shared state; only merge gates serialize (
trajectories = fleet ∧ teacher, training = data ∧ eval ∧ GPU, RL = SFT warm-start). - White space we claim: open weights + published verified trajectories · blue-side RLVR · red-trains-blue loop · procedural randomized environments · Prime-Intellect-distributable.
- Legally clean only: no HTB/PortSwigger/THM-derived training content (HTB AUP §6.2/§7.2); disclosed-only bounty material; license screen on everything.
Streams
| Stream | What | Status |
|---|
| A — Dataset triage | sweep 1,205+ HF cyber datasets, lineage-collapse, tier-ordered deep dives | 🟡 sweeping |
| B — Competitor dossiers | Bugcrowd ✅ HTB ✅ CyberFactory ✅ Landscape ✅ Primus ✅ XBOW ✅ CyberSOCEval ✅ UK AISI ✅ | 🟢 8/8 done |
| C — Explainers | 12-title terminology library, Karpathy-style | 🟢 12/12 done |
| D — Fleet | vulhub farm · dojo · EVM asserts · AgentDojo · k8s-goat · procedural generator · purple loop · held-out eval | 🟢 built; webapp-asserts + vulhub-farm live-smoked on docker, dojo build pending GPU-less budget |
| E — Wiki + site | this vault → site/ → Cloudflare Pages | 🟢 LIVE at cyber-factory.pages.dev |
| F — Eval harness | TB 4.0, CyberGym-E2E, ExploitBench, BountyBench, CVE-Bench, Garak, blue eval, decontam | ⚪ queued |
| G — Data | buy-list pulls + ARVO/OSS-Fuzz instance rebuild (CyberFactory-from-spec) | ⚪ queued |
Dossiers (read these first)
Queue
| stream | pending | in progress | done |
|---|
| A | 976 | 0 | 15 |
| all | 976 | 0 | 15 |
Results
See RESULTS.md — one row per model release, delta vs baselines (CyberTiel / CyberStrike / base Qwen).
Changelog
- 2026-11-02 (night+) — census complete: 52,072 enumerated → 984 relevant after screen; 976 deep-dive tickets queued (525 CLEAN / 55 PERSONAL / 26 GATED / 378 unknown-license); queue draining.
- 2026-11-02 (late) — docker runtime (colima) stood up; live fleet smokes: webapp-asserts PASS (real DVWA+Juice Shop, DB canaries), vulhub-farm PASS (319 envs, fastjson-RCE smoke under emulation), dojo PARTIAL (build deferred); site links fixed + verified 5/5 live; queue stats live in cockpit.
- 2026-11-02 (night) — queue drain #1: 15 trending datasets deep-dived (2 strong: HolyCyber, Trendyol; 5 situational; 8 avoid — incl. Vyber07 confirmed PERSONAL-tainted and CyberSecurity-1M homogenization risk); stream A live.
- 2026-11-02 (evening) — full fan-out landed: 8/8 dossiers, 12/12 explainers, 8/8 fleet families (selftests green: evm 30/30, agentdojo 21/21 vs real package, k8s 16/16, procedural-gen 84 checks, purple-loop Sigma scoring live); site live on CF Pages.
- 2026-11-02 — factory founded; strategy pivoted census-first → fleet-first after advisor synthesis; 4 dossiers landed; wiki + queue + tools scaffolded.