NUWA Risk Evaluation · Benchmark
AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges
NUWA research note · independent review pending
NUWA Research Note
Research questionDesign and assumptionsSource findingsNUWA interpretationLimits and contrary evidenceResearch connectionsResearch and decision relevanceInstitutions and rolesOriginal resourcesModel-assisted reading · Team research introduction only; complete protocol methods remain unavailable.
Affiliation disclosure: this research is associated with the organization maintaining this site. See the attribution section for its role.
At a glance
AgentCyberRange’s team introduction describes state-dependent attack progression across an enterprise-like range. The primary site shell does not disclose a complete experimental method in the cached response.
Research question
Can an agent discover an attack surface from sparse entry information and continue making decisions as access and information accumulate?
Design and assumptions
The team introduction starts agents from entry IP information and describes progression through linked environments. Earlier access and discovered clues change later options. Web and post-access tracks are presented separately. The trajectory figure retains unsuccessful exploration as well as successful progress, illustrating a process rather than just a final endpoint.
Source findings
The introduction explicitly distinguishes vulnerability reproduction from autonomous range progression: the starting information and task structures differ (适用范围).
The trajectory example shows reuse of acquired state and includes failed branches. It is one source-described trajectory, not evidence that every tested system follows that path (图 2).
The introduction’s environment scale is a different snapshot from the older leaderboard capture. These versions must not be merged into a single task denominator (环境规模).
NUWA interpretation
The material supports a scope-level account of the intended construct and one trajectory example. It does not yet support a fully audited methods dossier or a matched comparison across submissions.
Limits and contrary evidence
The cached project page is a JavaScript shell. The accessible research introduction omits complete scoring, budget, model-release identity and independent-run counts. A trajectory figure cannot establish a population rate. The introduction’s application requests do not prove deployments or partnerships.
Research connections
The introduction directly contrasts CyberGym’s code-plus-vulnerability inputs with AgentCyberRange’s entry-point information and attack-chain structure. This supports complementary coverage, not numerical equivalence.
Research and decision relevance
Model recommendation: obtain the archived benchmark specification and submission configuration before interpreting model gaps; use the introduction for task scope and process reading only.
Precise source locations
- AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks · 研究问题Research introduction captured 2026-10-27T09:55:41.654036+00:00; sha256:82b125ff6ee2fc02acde66bd7e5debed251334d1db9d88f7831aaae13e267a7f
- AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks · 长程攻击轨迹：状态与线索复用；失败路径与任务过程；图 2Research introduction captured 2026-10-27T09:55:41.654036+00:00; sha256:82b125ff6ee2fc02acde66bd7e5debed251334d1db9d88f7831aaae13e267a7f
- AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks · 任务设置与环境：攻击链与状态依赖；环境规模Research introduction captured 2026-10-27T09:55:41.654036+00:00; sha256:82b125ff6ee2fc02acde66bd7e5debed251334d1db9d88f7831aaae13e267a7f
- AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks · 适用范围Research introduction captured 2026-10-27T09:55:41.654036+00:00; sha256:82b125ff6ee2fc02acde66bd7e5debed251334d1db9d88f7831aaae13e267a7f
- AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks · 项目与更新Research introduction captured 2026-10-27T09:55:41.654036+00:00; sha256:82b125ff6ee2fc02acde66bd7e5debed251334d1db9d88f7831aaae13e267a7f
Source checking, extraction, editorial approval and replication are recorded separately. Methodology →
Institutions and roles
Evaluation protocols
Cite and reuse
Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.
Original publication · BibTeX
@misc{agentcyberrange,
title = {AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges},
url = {https://agentcyberrange.io/},
version = {Website bundle routes-B-0Mubrq.js / 2026-10-24 capture},
note = {Website bundle routes-B-0Mubrq.js / 2026-10-24 capture}
}
NUWA record · BibTeX
@misc{agentcyberrange-nuwa,
title = {AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges — NUWA research record},
url = {https://whitzard.tech/en/nuwa/whitzard-index/work/agentcyberrange/},
version = {2026-10-29.1},
organization = {NUWA Frontier AI Safety Lab},
howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentcyberrange.json},
note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--agentcyberrange.json.}
}
Evidence snapshot 2026-10-29.1 · Index updates · RSS
References
- [1] AgentCyberRange: Evaluate Agent Cyberattack Capabilities in Enterprise-like Cyber Ranges ; Official project: Web exploitation / Post exploitation tracks; Level-0 submission records
- [2] AgentCyberRange: Evaluating autonomous cyber capabilities over long-horizon tasks ; Research introduction: Fudan–Whitzard team; 研究问题; 长程攻击轨迹：状态与线索复用；失败路径与任务过程；图 2