Building AI for cyber defenders

This post argues that AI has reached "an inflection point" for cybersecurity and describes what Anthropic did about it in training Claude Sonnet 4.5. It was first published on 29 September 2025 on the Frontier Red Team's blog, red.anthropic.com. The anthropic.com page now gives the same date and credits the Frontier Red Team, with no individual authors; an earlier version of that page, captured in May 2026, was dated 3 October 2025 under Policy and carried a closing note that the post originally appeared on red.anthropic.com. It is a short evaluation post rather than a paper: it gives headline benchmark results, describes the training emphasis in general terms, and quotes two industry partners. For this library it is a case of a developer choosing which capabilities to strengthen on the grounds of who will use them, and of how repeated attempts change what an evaluation measures.

Why the post says this moment matters

The post cites several lines of evidence that models had become useful for real security work over the previous year (introduction). Anthropic had shown that models could reproduce the 2017 Equifax breach in simulation, entered Claude in competitions where it sometimes outperformed human teams, and used it to find vulnerabilities in its own code. In DARPA's AI Cyber Challenge, teams used language models, Claude among them, to build systems that found and sometimes patched previously unknown vulnerabilities. On the misuse side, Anthropic's Safeguards team had disrupted a "vibe hacking" case in which one person used Claude to run a data extortion scheme, and had detected Claude's use in espionage operations by an actor "consistent with Chinese APT operations," described in Anthropic's August 2025 threat intelligence report.

From this the post concludes that defenders should not "cede the cyber advantage derived from AI to attackers and criminals," and that the most scalable response is to equip security teams, researchers and open-source maintainers.

What Anthropic changed in training

Cybersecurity skills such as solving Capture-the-Flag (CTF) challenges had arisen as byproducts of general training. For Sonnet 4.5, a small research team instead worked directly on finding vulnerabilities in codebases, patching them, and testing for weaknesses in simulated deployed infrastructure (section "Evidence from evaluations"). The post states that the team "deliberately avoided enhancements that clearly favor offensive work," naming advanced exploitation and malware writing as examples. It does not describe the training data or methods.

What the evaluations show

The post stresses running each evaluation many times, since a motivated attacker or defender can make repeated attempts. The success measure is the probability that at least one of k attempts succeeds, averaged over problems (caption to the Cybench chart).

• Cybench, a benchmark of CTF challenges. With 10 attempts, Sonnet 4.5 solved 76.5% of challenges, against 35.9% for Claude Sonnet 3.7 with 10 attempts, released in February 2025. Sonnet 4.5 with one attempt had a higher success probability than Opus 4.1 with ten. One challenge, which involved analysing network traffic and extracting, decompiling and decrypting malware, took Claude 38 minutes; the post estimates a skilled human would need at least an hour. Results are on 37 of the 40 Cybench problems, three being excluded for implementation difficulties (section "Cybench").
• CyberGym, a benchmark of finding known vulnerabilities in real open-source projects from a description, and of discovering new ones. Under the public leaderboard's limit of $2 of API queries per vulnerability, Sonnet 4.5 scored 28.9%, a new state of the art. With 30 attempts per task and no cost limit it reproduced vulnerabilities in 66.7% of programs, at about $45 per task for all 30 attempts. Opus 4.1 was not held to the $2 limit in the single-trial comparison (section "CyberGym", chart note).
• New vulnerabilities. The CyberGym leaderboard shows Claude Sonnet 4 discovering new vulnerabilities in about 2% of targets; Sonnet 4.5 did so in 5% with one attempt and in over 33% of projects with 30.
• Patching. In preliminary work, Sonnet 4.5 patched CyberGym vulnerabilities given a description and crash information, and Claude judged the patches against human-written references. 15% were judged semantically equivalent. Because a vulnerability can be fixed in more than one valid way, this comparison produces false negatives. A manual check of a sample of the highest-scoring patches found them functionally identical to reference patches merged into the original projects (section "Further research into patching").

Two partners are quoted. HackerOne's chief product officer said Sonnet 4.5 reduced average vulnerability intake time for its security agents "by 44% while improving accuracy by 25%"; CrowdStrike's chief scientist described "strong promise for red teaming." These are testimonials, not evaluations the post reports in detail.

Instructions and choices described

The post contains no principles or prompts. The choices it describes are at the level of training priorities: which skills to strengthen (discovery, patching, testing of simulated infrastructure) and which to leave alone (advanced exploitation, malware). It also mentions a monitoring practice: organization-level summarization, which looks across many requests to separate dual-use from malicious activity rather than judging a single prompt (section "What's next?").

Limitations

• Benchmarks, not deployments. The post itself says real defensive work is "more complicated in practice than our evaluations can capture," and that many of the model's capabilities "do not yet match those of security professionals and established processes."
• Thin method detail. It gives no information about how the defensive training was done, and no evidence on whether avoiding offensive enhancements changed offensive capability.
• Self-judged patches. The 15% figure comes from Claude grading Claude against references, with known false negatives.
• Subset and cost conditions. Cybench results use 37 of 40 problems, and the CyberGym comparison applies different cost limits to Opus 4.1.
• Dual use. Vulnerability discovery helps attackers as well as defenders; the post addresses this through monitoring and safeguards rather than through evaluation results.

Research questions

1. Did avoiding offensive enhancements limit offensive capability? The post says such enhancements were avoided. Measuring exploitation and malware-writing tasks on Sonnet 4.5 against a model trained without the defensive emphasis would show whether the defensive training also raised offensive skill.
2. How should repeated attempts be reported? Success rose sharply from 1 to 30 attempts. Reporting full pass-at-k curves with cost per attempt would let readers judge capability for actors with different budgets.
3. How accurate is model-judged patch equivalence? Comparing Claude's equivalence judgments with human review and with test-suite results on the same patches would estimate the false-negative rate the post acknowledges.
4. Do benchmark gains carry over to defenders' workflows? The partner figures are testimonials. Controlled studies of time to triage and fix vulnerabilities with and without the model would test the post's practical claim.
5. Does organization-level summarization separate misuse from defense? Measuring its precision and recall on labeled dual-use and malicious activity would show how well the monitoring approach works.

How it connects

• The model. The post concerns Claude Sonnet 4.5, whose release is documented in the Claude Sonnet 4.5 system card, and compares it with Claude Opus 4.1 (Claude Opus 4.1 system card addendum). The addendum reports Cybench as challenges solved out of 35, while the post uses a 37-problem subset and success over k attempts, so the figures are not directly comparable.

References

• Anthropic Frontier Red Team. (2025, September 29). Building AI for cyber defenders. https://www.anthropic.com/research/building-ai-cyber-defenders
• Anthropic. (2025, August). Threat Intelligence Report: August 2025. https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf. Linked in the post for the espionage case (report p. 18); the report also describes the vibe hacking case (pp. 4 to 10), which the post links to a separate news post.
• Zhang, A. K., et al. (2025). Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models. ICLR 2025. Cited in the post; not read for this note.
• Wang, Z., et al. (2025). CyberGym: Evaluating AI Agents' Cybersecurity Capabilities with Real-World Vulnerabilities at Scale. arXiv:2506.02548. Cited in the post; not read for this note.