To Defend Against Cyber Attacks, We Must Teach AI Agents to Hack
Monash University（墨尔本大学）；University of California, Los Angeles（加州大学洛杉矶分校）；University of California, Santa Barbara（加州大学圣巴巴拉分校）；National University of Singapore（新加坡国立大学）
Terry Yue Zhuo, Yangruibo Ding, Wenbo Guo, Ruijie Meng
For over a decade, cybersecurity has relied on human labor scarcity to limit attackers to high-value targets manually or generic automated attacks at scale. Building sophisticated exploits requires deep expertise and manual effort, leading defenders to assume adversaries cannot afford tailored attacks at scale. AI agents break this balance by automating vulnerability discovery and exploitation across thousands of targets, needing only small success rates to remain profitable. Current developers focus on preventing misuse through data filtering, safety alignment, and output guardrails. Such protections fail against adversaries who control open-weight models, bypass safety controls, or develop offensive capabilities independently. We argue that AI-agent-driven cyber attacks are inevitable, requiring a fundamental shift in defensive strategy. In this position paper, we identify why existing defenses cannot stop adaptive adversaries and demonstrate that defenders must develop offensive security intelligence. We propose three actions for building frontier offensive AI capabilities responsibly. First, construct comprehensive benchmarks covering the full attack lifecycle. Second, advance from workflow-based to trained agents for discovering in-wild vulnerabilities at scale. Third, implement governance restricting offensive agents to audited cyber ranges, staging release by capability tier, and distilling findings into safe defensive-only agents. We strongly recommend treating offensive AI capabilities as essential defensive infrastructure, as containing cybersecurity risks requires mastering them in controlled settings before adversaries do.
Quantifying Loss Aversion in Cyber Adversaries via LLM Analysis
USC Institute for Creative Technologies（南加州大学创意技术研究所）；Northeastern University（东北大学）；University of Southern California（南加州大学）；Carnegie Mellon University（卡内基梅隆大学）；Simmons University（西蒙斯大学）
Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；Network Management Center, China Mobile Group Liaoning Company Limited（中国移动集团辽宁公司网络管理中心）；Tencent Security Xuanwu Lab（腾讯安全宣武实验室）；China Unicom Online Information Technology Co., Ltd.（中国联通在线信息技术有限公司）
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
National Institute of Standards and Technology（美国国家标准与技术研究院）；Université Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；CNRS（法国国家科学研究中心）；University of Maryland, College Park（马里兰大学帕克分校）
INK: Inheritable Natural Backdoor Attack Against Model Distillation
Institute of Computer Application, China Academy of Engineering Physics（中国工程物理研究院计算机应用研究所）；Faculty of Electronic and Information Engineering, Xi’an Jiaotong University（西安交通大学电子与信息工程学院）；School of Cyberspace Security, Beijing University of Posts and Telecommunications（北京邮电大学网络空间安全学院）
针对可信数据集蒸馏可阻断传统投毒后门的问题，本文提出 INK，以自然图像方差为触发器，在无训练数据访问权时实现可从教师迁移到学生的干净图像、干净标签攻击，蒸馏后 ASR 仍超 98%。
