VARAS-OneMind on ExploitGym: Capability-Led Exploitation at Scale

Overview

ExploitGym is a binary-exploitation benchmark from UC Berkeley spanning userspace programs, V8, and Linux kernel targets. Each instance comes with a description of the vulnerability and a proof that it can be triggered; the agent must turn that starting point into a working exploit that retrieves a flag from a separate target environment.

In each instance the vulnerability and a way to trigger it are therefore given; what remains is the exploitation itself. VARAS-OneMind is an agent system built for that stage: it must turn the given reachability into an end-to-end exploitation path that reaches the objective, under a fixed time limit and without human intervention. This is where long-horizon difficulty concentrates: the space of possible chains is large, and intermediate feedback is partial and often misleading. This post describes the design principles behind VARAS-OneMind and reports its performance on two model configurations: GLM-5.3 and DeepSeek-V4.1-Flash.

Capability-Centric Exploit Memory

A common way to organize an exploitation agent is around activity: survey the target, try an idea, move on. On long-horizon targets that is a poor guide, because the agent cannot tell progress from motion. VARAS-OneMind is organized around capabilities instead.

Exploitation is treated as the acquisition of a capability chain. A capability is the effect that a specific primitive can achieve, and progress is therefore measured in effects the agent has actually produced: each one descends from the supplied vulnerability and feeds the next, until the chain reaches the flag. A capability counts only once the target itself has been shown to behave that way; an idea that has not yet survived contact with the target is not progress, however plausible it reads. Requiring every link to be consumed by the next one has a second effect: the finished exploit explains itself, because the route from the supplied vulnerability to the flag is the same object the system was optimizing rather than a story assembled afterwards. It also means off-target shortcuts are excluded by construction rather than penalized after the fact.

In structure, accepted capabilities are the nodes and candidate branches are the edges: exploring an exploit therefore takes the shape of a tree, in which every step can be traced and is expected to stand on evidence. The chain that reaches the flag is one path through that tree.

The chain is held in an explicit exploit memory rather than carried implicitly in the conversation: conclusions are recorded compactly and traceably, while measurements and artifacts stay outside it. That memory is what the agent re-reads when it resumes, so progress survives context compaction — however often the working context is compressed or rebuilt, the agent continues from what has actually been established rather than from a reconstruction of what it discussed.

The same property keeps a run auditable while it is still in flight: the state of the route can be inspected at any point, rather than inferred from the transcript of the last few minutes.

Stage-Governed Global Workflow

Exploitation unfolds through distinct stages, from understanding a target to extracting a first primitive, composing a chain, validating it, and finally reproducing it against the real remote target. Each stage has its own notion of progress, and many failures are stage errors: work that is reasonable in itself but premature.

VARAS-OneMind makes that structure explicit and keeps the agent’s global position visible throughout. The agent works where the task actually is, keeps a route only as far as evidence supports it, and can fall back to what has already been established without rebuilding it. The next step is therefore chosen by the state of the route rather than by the momentum of recent activity.

This matters most precisely where exploitation is hardest. Long-horizon targets reward depth: a single promising thread can absorb an entire run while the route as a whole never reaches a usable primitive. By making the current stage and its exit condition the unit of decision-making, the workflow keeps local effort subordinate to the global route — the agent may go deep on a thread, but only where that depth is what the current stage actually requires.

Operator Protocol and Steering

A single operator protocol owns each run end to end. It can dispatch bounded work to executors when a sub-goal belongs to a different discipline, which keeps the operator’s own context focused on the route as a whole rather than on individual procedures. Delegation here is a decision about attention as much as about division of labor: a narrowly scoped sub-goal is best pursued by something that can hold all of it at once, while the route itself stays with the operator.

The protocol also re-grounds the work periodically. Long runs drift: recent actions acquire weight they have not earned, and a thread opened as a means ends up treated as the goal. Requiring the agent to re-derive where the run actually stands — which stage it is in, what has been established, what is still missing — is what keeps the route, rather than the momentum of the last few steps, in control of what happens next.

Alongside the target itself, it draws on reusable expert knowledge: general domain background and methodological heuristics that carry across targets.

Security Tooling

The agent is provisioned with an additional set of specialized security tools for exploit development — exploit scripting and gadget search among them. These tools support what the exploitation stage requires in practice: turning an established primitive into a payload that runs against the target.

Results

A capture counts as on-target only when the supplied vulnerability is causally necessary to the path that obtained the flag; an independent judge model decides this for each captured flag. The setup, including the judge model, is listed for each run below.

GLM-5.3 Results

Evaluation Setup

• Benchmark: ExploitGym, at commit e4123d0 of the benchmark repository.
• Instances: 264 instances (a subset of the benchmark).
• Agent: VARAS-OneMind driving GLM-5.3.
• Defense profile: mitigations disabled — userspace exp.none, V8 nodefense, kernel default capability set.
• Time limit: six hours per instance.
• Judge model: DeepSeek-V4-Flash.

Captures

Across the 264 evaluated instances, VARAS-OneMind captured 175 flags, of which 159 were judged on target.

By Task Family

Across the set, the agent spent 903 hours and issued 139,057 model requests, at an estimated inference cost of $9,188.

DeepSeek-V4.1-Flash Results

Evaluation Setup

• Benchmark: ExploitGym, at commit e4123d0 of the benchmark repository.
• Instances: 314 instances (a subset of the benchmark).
• Agent: VARAS-OneMind driving DeepSeek-V4.1-Flash.
• Defense profile: mitigations disabled — userspace exp.none, V8 nodefense, kernel default capability set.
• Time limit: six hours per instance.
• Judge model: DeepSeek-V4.1-Flash.

Captures

Across the 314 evaluated instances, VARAS-OneMind captured 249 flags, of which 206 were judged on target.

By Task Family

Across the set, the agent spent 974 hours and issued 129,755 model requests, at an estimated inference cost of $841.

Summary

Treating exploitation as the acquisition of a causal chain of capabilities — and giving the agent an explicit, small, evidence-linked state in which to track that chain — produces a system that is measurable while it works and honest about what it has proven. Driven by GLM-5.3 on a 264-instance subset of ExploitGym with mitigations disabled, VARAS-OneMind produces 159 on-target captures, with only 16 off-target. Driven by DeepSeek-V4.1-Flash on a 314-instance subset of the same benchmark, it produces 206 on-target captures.