ExploitGym (2h)

ExploitGym (2h) is a benchmark for offensive and defensive security work. The official description says: "ExploitGym exploitation benchmark, single-run Pass@1 on 869 tasks under a 2-hour timeout budget (API inference time rescaled by per-model TPS from Artificial Analysis plus non-API overhead), evaluated in Claude Code 2.1.207 with max reasoning effort, no web tools, and a domain whitelist". Below we describe in simple words what benchmarks of this type generally examine.

ExploitGym (2h) measures offensive and defensive security work. In detail, it checks:

• finding and exploiting (or fixing) vulnerabilities in controlled environments
• reasoning about exploits, payloads and attack paths
• staying within the rules of the sandboxed security exercise
• documenting and reproducing the steps taken

The score is a simple count of challenges the agent completed within the time budget. More solved challenges is better.

Official methodology note: ExploitGym exploitation benchmark, single-run Pass@1 on 869 tasks under a 2-hour timeout budget (API inference time rescaled by per-model TPS from Artificial Analysis plus non-API overhead), evaluated in Claude Code 2.1.207 with max reasoning effort, no web tools, and a domain whitelist. Reported in the GLM-5.3 model card.

What is the ExploitGym (2h) benchmark?

ExploitGym (2h) is a benchmark for offensive and defensive security work. The official description says: 'ExploitGym exploitation benchmark, single-run Pass@1 on 869 tasks under a 2-hour timeout budget (API inference time rescaled by per-model TPS from Artificial Analysis plus non-API overhead), evaluated in Claude Code 2.1.207 with max reasoning effort, no web tools, and a domain whitelist'. Below we describe in simple words what benchmarks of this type generally examine.

What does ExploitGym (2h) test?

ExploitGym (2h) mainly measures offensive and defensive security work. Concretely, it checks: finding and exploiting (or fixing) vulnerabilities in controlled environments; reasoning about exploits, payloads and attack paths; staying within the rules of the sandboxed security exercise.

How is the ExploitGym (2h) score calculated?

The score is a simple count of challenges the agent completed within the time budget. More solved challenges is better. The declared maximum score of this benchmark is 869.0.

Where do I get ExploitGym (2h) data and scores?

The official benchmark page/reference is linked on this page. Every score on Open LLM Radar is also available as open data: download the scores JSON (http://open-llm-radar-api:8000/api/v1/benchmarks/exploitgym-2h/scores) or pull it directly from the Open LLM Radar API with any HTTP client.