Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models

AI summary

Overview

Research area: Post-training of open-weight large language models for agentic cybersecurity work, with a focus on the data-construction and supervision-elicitation pipeline rather than model architecture.

Technical level: Advanced. The paper assumes familiarity with supervised fine-tuning, reinforcement-learning-shaped reasoning, model merging, agentic multi-turn trajectories, CTF and vulnerability-reproduction environments, and API-level access controls.

One-sentence scope: The paper describes five named supervision techniques and an environment-grounded data engine that together produced 164,269 audited trajectories used to post-train three open-weight checkpoints (Feyospace-s0, Feyospace-s1, Feyospace-s2) that rank 1st among models at comparable parameter scales on CyberGym.

Note on completeness: the supplied paper content is truncated partway through Section 2.3. Sections 3 (data pipeline), 4 (SFT objective and training) and the detailed descriptions of PSBreakup and Kreator are not present in the content, so this summary reports only what the available text states and flags what is not reported.

What This Paper Is About

Training capable cyber agents is often framed as a model-scale problem, but the paper argues that open-weight post-training is limited more directly by three practical costs: building executable environments, obtaining reliable multi-turn supervision, and gaining access to strong teacher models. The authors, a self-described seven-person independent team, set out to show that a purely data-centric pipeline — grounded environments plus recovered or reconstructed teacher trajectories — can lift existing open-weight models to leading agentic cyber performance.

Key Contributions

1. A five-technique supervision framework. Choulea analyzes hidden reasoning signatures; SkyReal reduces teacher-sampling cost through low-cost account supply; Hongzwang elicits teacher behavior under API and inference constraints; PSBreakup uses white-box model-merge reversal to expose target-domain capabilities latent in an open-weight checkpoint before SFT; and Kreator converts a human expert intervention at a critical failure state into a teacher-native trajectory.

2. An environment-grounded cyber data pipeline. The engine covers repository-level coding (27,502 multilingual instances under fresh-container execution), vulnerability environments (69,854 from public vulnerability records), author-maintained CTF environments (9,312), verified Linux kernel-history environments (12,993), 1,601 execution-verified exploit cases, and a hardware route of 1,377 environments (1,003 firmware re-hosts and 374 device-backed). Every candidate trajectory passes execution verification and a four-layer evidence audit.

3. A released corpus and three trained checkpoints. The resulting training mixture contains 164,269 audited trajectories — 28,177 from basic coding environments and 136,092 from security and hardware environments — used to post-train Qwen3.6-35B-A3B, Qwen3.8-27B, and Qwen3.5-122B-A10B.

4. An end-to-end demonstration by a small independent team. The paper states it is the first end-to-end demonstration that a seven-person independent team can train open-weight models with leading agentic cyber capability, and the authors commit to releasing the training trajectories used.

Main Findings

• Post-training gains on cyber benchmarks. Averaged across the three checkpoints, post-training improves the CyberGym verified success rate by 23.76% and the pooled CTF success rate by 10.49% over the respective starting checkpoints.

• Leaderboard placement. As of September 1, 2026, Feyospace-s1 achieves a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard; all three checkpoints rank 1st among models at comparable parameter scales.

• Choulea's recovery rates and their limits. Before the August 21, 2026 defensive update, the system achieved a weighted aggregate recovery rate of 92.8% on original traces from three providers (OpenAI, Anthropic, Google). After the update, Generation 5 achieved mean success rates of 67% for traces below 4096 reasoning tokens and 39% for longer traces. Recovery success evolved across generations: Gen. 1 (Gemini 3.1 Pro) above 30% / 0%; Gen. 2 (Claude Opus 4.6) 55% / 9%; Gen. 3 (Claude Opus 4.8) 63% / 11%; Gen. 4 (Fable 5) 85% / 32%; Gen. 4.5 (Fable 5) 98% / 91%; Gen. 5 (Opus 5; Fable 5; GPT-5.6 Sol) 67% / 39%. Generations 1–3 are disclosed; Generations 4, 4.5 and 5 carry the author-defined "IDC" disclosure code.

• High recoverability did not translate into training value. Despite the recovery rates, the recovered traces were excluded as SFT targets. Reasons given include insufficient budget for provider-specific cleansing, reverse-trap detection, conflict-aware training and large-scale ablation; a highly non-stationary GPT distribution over atomic-operation compositions; Claude traces containing anomalous structures consistent with a possible provider-injected reverse trap; and Gemini failing to meet the minimum downstream-performance threshold. The paper states the result shows that high trace-recovery rates do not necessarily imply positive training value.

• Reasoning has model-specific structure. Extraction and consolidation over 100,000 traces produced several thousand deduplicated, provider-characteristic compositions across OpenAI, Anthropic, and Google. The paper defines an atomic operation as the smallest recurring control unit in a reasoning trace that triggers an identifiable cognitive-state transition, and a model's "cognitive dialect" as the distribution over these compositions and their transition rules.

• Three sources of compositional conflict. Version differences within a family (Gemini 3.7 Flash versus Gemini 3.5; Claude Opus 4.6 versus Opus 4.8; Opus 4.7 described as an anomalously weak intermediate release with near-zero reusable training value); distributional differences between families such as Gemini and GPT; and strategy differences across reasoning-effort settings, including within Fable 5 and between GPT-5.6 Sol's max and medium traces.

• Extractable compositions contract over time. Under a fixed problem set, extractor version and deduplication rule, Fable 5's deduplicated compositions fell from 671 (before August 1) to 429 (August 1–7), stayed between 396 and 447 (August 7–21), and decreased slightly further to approximately 370 after August 21, while recovered traces also became shorter.

• SkyReal's measured economics. Channel-level leverage ranges from approximately 9.5× (Regular, 0.084 USD, 30d) to 331× (Pls trial, 0.38 USD, 7d), with K2 at 0.14 USD / 5h / 27 USD / roughly 193× and Bonboncar team at 0.56 USD / 7d / 62 USD / roughly 111×. The 429-reset mechanism adds roughly 2× multiplicative leverage, giving a consumption-weighted system-wide average of approximately 273×, i.e. every 1 USD of spending delivers tokens with a nominal value of about 273 USD. The paper estimates about 5.9% of API token consumption in Southeast Asia flows through this class of systems. SkyReal was not used in the final training pipeline.

• Hongzwang's strategy result. On the residual benchmark unresolved by strategies S1 through S6, the S7 renaming-and-competitive-challenge strategy resolves an additional 39% of cases. Hongzwang was also not used in the final training pipeline because it did not meet internal requirements.

Authors’ abstract

Training capable cyber agents is often treated primarily as a problem of model scale, yet open-weight post-training is constrained more directly by the cost of executable environments, reliable multi-turn supervision, and access to strong teachers. We present a data-centric framework that addresses these bottlenecks through five complementary systems: Choulea analyzes hidden reasoning signatures, SkyReal reduces teacher-sampling cost, Hongzwang bypasses API restrictions on teacher execution, PSBreakup restores capabilities weakened by model merging, and Kreator converts expert interventions into trainable reasoning. Our data engine constructs resettable coding, vulnerability, CTF, kernel-history, full-exploit, firmware, and device-backed environments. Candidate trajectories are retained only after execution verification and evidence auditing, yielding 164,269 trajectories for long-context supervised fine-tuning. The three checkpoints improve over their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across the pooled CTF suites. As of September 1, 2026, Feyospace-s1 achieves a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard, while all three checkpoints rank 1st among models at comparable parameter scales. To our knowledge, this is the first end-to-end demonstration that a seven-person independent team can train open-weight models with leading agentic cyber capability.