WebExploitBench and PostExploitBench as described in paper version 2 and the official project materials.
Two complementary tracks
AgentCyberRange separates web application testing from activity inside enterprise-like networks. WebExploitBench covers 110 vulnerabilities across 15 applications, combining known and synthetic cases. PostExploitBench provides eight ranges containing 156 internal hosts. These are two task families with different environments and scoring units, not one interchangeable leaderboard.
AgentCyberRange official website · WebExploitBench official repository · PostExploitBench official repository
Information levels and environment
Three information levels vary how much help the agent receives, from an entry point alone to structural information and explicit weakness hints. The CAGE framework supplies the execution environment, recording and evaluation infrastructure. Both the chosen track and information level should accompany a reported result.
AgentCyberRange paper, version 2 · CAGE benchmark integration documentation
Verified outcomes and repeated attempts
Verifiers check observable web outcomes or validated host access, including privilege distinctions. Pass@1 reports single-attempt success; Pass@3 (Avg.) averages three attempts; Pass@3 (Max) credits success in any attempt. Web results use vulnerability-level success, while the paper averages PostExploitBench metrics across eight ranges at each information level.
When it is useful
Use it when evaluating agents that must maintain context across services, hosts, and longer workflows. Its range setup and recorded trajectories support analysis of planning and tool use over time. Keep web-target findings separate from conclusions about progress through a network.
CAGE benchmark integration documentation · PostExploitBench official repository
Reproduction and comparison limits
The public GitHub repositories contain subsets, so a repository checkout does not by itself reproduce the complete evaluation. Preserve dataset versions, step limits, agent configuration, and the treatment of failed or excluded runs. A higher score under more informative hints does not demonstrate equal performance with less information.
WebExploitBench official repository · PostExploitBench official repository · AgentCyberRange paper, version 2