The story
150,000exploits.One model that read them all.
We wrote working exploits for 150,000 CVEs, proved each one in a sandbox, and trained a model on what we learned. This is how autter-large and autter-flash came to read attacks the way an analyst does.
Log4Shell
- exploit.py
- ldap_server.py
- PATCH.md
- detect.sigma.yml
01/ The corpus
Start with the attacks.
Every finding our models return comes from reading attacks, so we started by writing them. For the vulnerabilities that matter to the teams we review for, we wrote working exploits: 150,000 of them, each tied to a CVE, the vulnerable version it targets and the exact lines that make it work.
02/ The sandbox
Prove every one of them.
An exploit that does not run teaches nothing. Each one ran against the vulnerable build in an isolated sandbox, the same isolation Autter uses for code review, and was kept only if it reproduced the vulnerability. The run log, the patch that closes it and the detection that catches it were saved beside it.
03/ The training
Teach reading, not refusing.
The model trained on the exploits, their patches, the logs they produce and the detections that catch them. It learned what an attack targets, how it gets in, what it leaves behind and how to close it. Nothing in that data teaches it to refuse.
04/ The measure
Score it against the gated models.
On CyberGym, autter-large scores 88.1% and autter-flash 84.2%, above OpenAI’s dedicated cyber model. Both are open to anyone with an API key.
05/ The loop
Keep writing.
The CVE catalogue grows every week, and so does the corpus. New vulnerabilities become exploits, exploits become training data, and both models are re-evaluated before every release.
Read the models that read them.
Two models, one base URL. Prepaid credits, nothing stored by default.