The Logic Gap in AI Cyber Defense

Modern frontier models (like GPT-4 and Claude Opus) excel at reconnaissance but fail at the high-level reasoning required for sophisticated cyber defense. While they can identify potential primitives or bugs, they struggle to build a dynamic 'world model' of a system. In complex scenarios—such as a chain of microservices involving Keycloak, Vault, and a broker—models often probe randomly without making the necessary logical connections to exploit a vulnerability.

This gap is analogous to the ARC-AGI benchmark, where models fail to understand how actions in one part of a system affect another. In a real-world exploit, such as a privilege escalation where a user must rename themselves to match an admin's ID, current models often reach the check but fail to execute the logical leap required to bypass the security control.

A New Approach: Human-Led Data and Deterministic Grading

Arithmetic is shifting the paradigm by creating cyber training data derived from human vulnerability research. Instead of relying on static code analysis, they:

• Find real zero-days: Human researchers discover vulnerabilities in widely distributed open-source software.
• Create blackbox environments: The model is given no access to the codebase or the internet, only basic tooling, forcing it to reason through the system's state.
• Implement deterministic grading: Because the tasks are complex, every step of the discovery and exploitation chain is verified. This allows researchers to measure exactly how deep a model gets into an exploitation chain, even if it fails to fully solve the task.

The Case for Open Source Defense

The speakers argue that the current defensive stack, which relies on limited human intervention, is insufficient against AI-powered attackers who can probe multiple targets simultaneously. They propose that the only way to replace this legacy stack is through:

• Specialized Models: Moving beyond general-purpose models to specialized defenders capable of rapid reasoning.
• Open Source Collaboration: Rejecting the binary view that open-source models are inherently less secure. Instead, they argue that open-source models are essential for democratizing defense, allowing companies to post-train models on their specific network environments.
• Speed as the Metric: The future of cyber security will be a speed race. Defenders must be able to detect and respond to threats faster than attackers, necessitating models that can run efficiently on specialized hardware.