for frontier AI labs

Cybersecurity RL environments, cooked from scratch.

A lot of ingredients go into a great eval environment. We're vulnerability researchers and bug hunters who know the recipe, and we make it delicious af.

Order a bowl See the menu

02 / the ingredients

What goes into a great RL environment.

Skip one ingredient and the whole pot goes bad. We don't skip any.

  • Real bugs

    Grounded in real-world vulnerability classes and real codebases, not toy puzzles.

  • Realistic targets

    Production-shaped apps, services and binaries, with all the mess of the real thing.

  • Verifiable rewards

    Deterministic flags and graders. The exploit works or it doesn't.

  • Unhackable rewards

    We attack our own environments so models can't shortcut their way to reward.

  • Real tooling

    Shells, proxies, debuggers, disassemblers and fuzzers. The kit a pro reaches for.

  • Tuned difficulty

    Curricula from warm-up to frontier-hard, calibrated against real solve rates.

  • Expert solutions

    Reference exploits and walkthroughs from people who do this for a living.

  • Variety

    Many languages, stacks and attack surfaces, so models generalize instead of memorize.

  • Built to scale

    Containerized, reproducible and ready for thousands of parallel rollouts.

03 / what we believe

The future of security is superhuman hackers.

AI agents will soon find and fix vulnerabilities faster, deeper and at a scale no human team can match. We want to push the boundaries of what they can do. That means environments built by people who've done the work for real, hard enough to stretch the best models and honest enough that the skills they learn are the real thing.

04 / the chefs

Cooked by hackers.

We're a team of top vulnerability researchers and bug hunters with a proven track record and decades of experience breaking real software. We've spent our careers finding the bugs that matter. Now we turn that instinct into environments that teach models to do the same.

  • Decades of hands-on offensive security
  • A proven track record of real-world finds
  • Every environment built and solved by experts

05 / the recipe

From order to bowl.

  1. 1

    Taste

    Tell us the capability you're targeting and how hard it should be.

  2. 2

    Prep

    We design scenarios from real bug classes, codebases and attack paths.

  3. 3

    Simmer

    We build, solve and red-team every environment for shortcuts.

  4. 4

    Serve

    Containerized envs, graders and reference solutions, delivered to your stack.

06 / faq

Questions from the table.

What is a cybersecurity RL environment?

A sandboxed, reproducible task where an AI agent works against a realistic target, such as a web application, an open-source library or a binary, and earns a verifiable reward for success, like capturing a flag or producing a working exploit. Labs use them to train and evaluate offensive security capabilities.

Who are your environments for?

Frontier AI labs and research teams that train or evaluate models and agents on offensive security tasks.

What kinds of environments do you build?

Realistic web application penetration testing scenarios, zero-day hunting in open-source libraries, and reverse engineering environments. We also build bespoke environments around the capability you want your model to learn.

How do you make sure models can't game the reward?

Graders check real outcomes, such as a captured flag or a working exploit, rather than what the agent claims. We also attack our own environments before shipping them to find shortcuts and close them.

Who builds the environments?

A team of top vulnerability researchers and bug hunters with a proven track record and decades of combined experience in offensive security.

Hungry?

Tell us what your models need to learn. We'll cook something bespoke.

Order a bowl

hello@evalsoup.ai