Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models

2609.08418 ↗ · 2026-09-08 · cs.AI

Zongjie Li, Alan Z. W, John Nicolas J, Walter H. F, Scott Donald L, Gordon Y. P, Deke X

The finding

Headline claim

A seven-person independent team can post-train open-weight Qwen models to near-frontier agentic cyber capability, improving over their starting checkpoints by 23.76% on CyberGym and 10.49% on pooled CTF suites, with Feyospace-s1 reaching a 63.24% verified success rate and rank 10 on the official CyberGym leaderboard.

The test

SFT-only post-training of three Qwen checkpoints (Qwen3.6-35B-A3B, Qwen3.8-27B, Qwen3.5-122B-A10B) on 164,269 execution-verified and audited trajectories drawn from 27,502 coding instances, 69,854 vulnerability environments, 9,312 CTF environments, 12,993 kernel-history environments, 1,601 verified exploit cases, and 1,377 hardware environments, evaluated on the full CyberGym suite and interactive CTF benchmarks in a shared agentic setup.

Effect size & scope

Average gain of 23.76 percentage points on CyberGym verified success rate across the three checkpoints and 10.49 points on pooled CTF suites; the best checkpoint hits 63.24% (rank 10 overall, rank 1 at comparable parameter scale as of September 1, 2026). Gains are measured only against each model's own starting checkpoint; no same-budget baseline comparison against other post-training methods is reported.

Limitations

The authors concede recovered teacher traces were never used as training targets due to funding and contamination risks, including suspected provider-injected reverse traps in some Claude traces; Generation 5 recovery rates dropped to 67%/39% after the August 21, 2026 provider defenses; some techniques (SkyReal's low-cost accounts, Hongzwang's API restriction bypasses) rest on gray-market access whose durability and legality are unaddressed. Unstated: leaderboard position is self-reported, teacher-model identity and contamination of the CyberGym benchmark are not audited, and 'rank 1 at comparable parameter scale' uses author-defined scale buckets.

Counterpoint

A skeptic would note the headline is a rank on a possibly contaminated public benchmark with no controlled baselines, no ablations isolating which of the five named techniques matter, no cost disclosure beyond an appendix stub, and a framing ('Cyber Mercury Seven') that reads as advocacy for open access rather than neutral science; the 23.76% improvement over the model's own base could reflect any competent SFT pipeline, and the trace-extraction component is demonstrated but explicitly not connected to the training results.

Economy implication

Little or nothing yet for mainstream AI economics in the next 12 to 24 months: the direct signals are that niche frontier-adjacent capability is achievable with small teams and modest capital, and that closed-lab reasoning traces are extractable enough to worry about, both of which modestly weaken the claim that staying capable requires frontier-scale budgets, but the evidence here is a self-reported benchmark result, not an economic measurement.

Who this matters for

Technical Capability: Shows that agentic cyber capability, a domain labs gate behind access programs, can be reached via open-weight post-training by a tiny team, weakening scale-based moats in this vertical.

Geopolitics & Security: Demonstrates a recipe where strong cyber agents depend on environments, supervision, and technique rather than compute scale, lowering the barrier for small or sanctioned actors.

Market & Valuation: If extractable reasoning traces and cheap teacher sampling hold up, the pricing power of closed frontier models in capability transfer erodes, a live risk to lab moat narratives.

Regulatory & Legal: The trace-extraction technique (Signature Hack) and its provider defenses sketch an emerging cat-and-mouse that regulators and providers would need to treat as a security and IP exposure, not a theoretical one.

Bears on (advisory · papers never write evidence)

[5.2] Open-weight models reach "good enough" parity for most economic use cases.

[5.4] The capital scale to stay frontier is itself a sustainable barrier.

[3.1] Inference cost per unit of capability is falling rapidly.

Abstract

Training capable cyber agents is often treated primarily as a problem of model scale, yet open-weight post-training is constrained more directly by the cost of executable environments, reliable multi-turn supervision, and access to strong teachers. We present a data-centric framework that addresses these bottlenecks through five complementary systems: Choulea analyzes hidden reasoning signatures, SkyReal reduces teacher-sampling cost, Hongzwang bypasses API restrictions on teacher execution, PSBreakup restores capabilities weakened by model merging, and Kreator converts expert interventions into trainable reasoning. Our data engine constructs resettable coding, vulnerability, CTF, kernel-history, full-exploit, firmware, and device-backed environments. Candidate trajectories are retained only after execution verification and evidence auditing, yielding 164,269 trajectories for long-context supervised fine-tuning. The three checkpoints improve over their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across the pooled CTF suites. As of September 1, 2026, Feyospace-s1 achieves a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard, while all three checkpoints rank 1st among models at comparable parameter scales. To our knowledge, this is the first end-to-end demonstration that a seven-person independent team can train open-weight models with leading agentic cyber capability.