Technical Summary: CAI Dataset

Problem Statement

The paper identifies a critical bottleneck in the application of Large Language Models (LLMs) to cybersecurity: while base-model capabilities have advanced, the performance of LLMs in real-world penetration testing and security operations is limited by the absence of expert operator trajectories. Previous research (PentestGPT) established that the "harness" (the agent framework guiding the model) and the specific multi-turn, tool-augmented workflows of human operators are more significant determinants of success than the underlying foundation model alone.

Existing public datasets fail to address this gap because they typically satisfy at most two of three necessary properties for effective Supervised Fine-Tuning (SFT):

1. Scale: Most cybersecurity corpora are orders of magnitude smaller than general-purpose SFT mixes (e.g., T¨ULU 3, OpenHermes).
2. Distributional Fidelity: Synthetic or instruction-based datasets (e.g., CySecBench, SecKnowledge) often exhibit a safety/performance trade-off and fail to capture the iterative, error-recovery, and tool-output interpretation behaviors of real operators.
3. Tool-Grounded Multi-Turn Structure: Benchmarks like CyberMetric or SecQA test factual recall but lack the "act–observe–revise" loops and tool-call schemas required for agentic workflows.

Furthermore, the industry trend toward gated, RL-optimized frontier models (e.g., GPT-5.5-Cyber) creates a dependency on opaque, remote APIs. This concentrates sensitive offensive and defensive operator context (live credentials, production hostnames, bearer tokens) within a handful of API providers, creating a single failure surface that poses systemic risks.

Methodology

The authors present CAI Dataset, a corpus engineered through the CAI (Cybersecurity AI) open-source agent framework. The framework was architected primarily as a data collector, with telemetry as a first-class subsystem.

• Data Collection: Over a 14-month period (March 2025 – May 2026), the CAI framework captured 230,935 session logs and 26,027,742 user prompts from 16,768 distinct source IPs across 123 countries.
• Behavioral Approach: The collection is strictly behavioral; no prompts were injected, and no synthetic data was generated. The dataset records real operators using their own prompts against their own targets, including failed steps, tool outputs, and re-planning.
• Schema and Redaction: Data is stored as JSONL session logs preserving the full messages[] array, including tool calls and provider responses. To address privacy and security, a consumer-side redaction recipe is applied to strip credentials (API keys, tokens) and infrastructure identifiers (hostnames, S3 buckets) before release.
• Access Model: The dataset is released as an audience-size series (CAI Dataset10, CAI Dataset1k, CAI Dataset200k) to partner organizations and selected customers, rather than as a public download, to mitigate dual-use risks while enabling research.

Key Contributions

1. Scale and Scope: CAI Dataset is the largest described corpus of LLM-driven cybersecurity trajectories, containing ~26 million user prompts and 18.07 TB of durable storage. It is approximately 65× larger than the next-largest cybersecurity training dataset (SecKnowledge) and three to four orders of magnitude larger than existing agent-trajectory corpora.
2. Operational Realism: The corpus captures the full spectrum of operator behavior, including:
   • Role Mix: 36.4% offensive, 20.1% attacker-intent, 27.5% business/integration, and 4.4% defensive prompts.
   • Tool Usage: Heavy usage of network tools (nc, nmap, curl) and web scanners (nikto, burp).
   • Workflow Complexity: Evidence of multi-stage kill chains (reconnaissance to persistence) executed within single sessions, often involving failed commands and iterative repair.
   • Target Diversity: References to 23,147 unique domains, including production banking, telecom, government, and IoT/robotics targets, not just synthetic CTF environments.
3. Model Diversity: The dataset exercises 4,187 unique LLM identifiers, reflecting operators' routine A/B testing of frontier models (e.g., GPT-5.x, Claude Opus 4, Gemini 3.1, Qwen3, DeepSeek) alongside local and quantized variants.
4. Leak Surface Analysis: The paper empirically quantifies the "leak surface," finding that 0.46% of sessions contain pasted credentials and 0.76% contain production infrastructure identifiers. This highlights the trade-off operators make between productivity and confidentiality when using remote APIs.

Results and Observations

• Growth and Cadence: The corpus grew at an average rate of ~540 session logs and 60k prompts per day. The data suggests a weekly retraining cadence is optimal for SFT pipelines to capture distributional shifts, as the daily increment represents ~0.23% of the corpus.
• Prompt Evolution: Prompt lengths have shifted from short shell-loop directives (~150 chars) to complex, multi-step planning briefs (400–1,300+ chars), driven by the sophistication of agent scaffolds.
• CVE Weaponization: Analysis of CVE mentions reveals a "long-tail" dominance of legacy vulnerabilities (e.g., CVE-2019-11248, CVE-2017-10271) over zero-days, though recent disclosures (2025–2026) are weaponized rapidly.
• Geographic Distribution: 85.7% of distinct contributors are in Europe, with significant clusters in Asia and North America. A notable 11.4% of traffic originates from public cloud/hosting providers, indicating scripted reconnaissance.
• Dual-Use Capability: The dataset contains verifiable examples of full attacker kill chains (recon, exploitation, privilege escalation, exfiltration, persistence) executed in under two hours, demonstrating the "observable criminal-capability uplift" provided by LLM-augmented agents.

Significance and Claims

The paper argues that CAI Dataset provides the necessary "missing substrate" for training cybersecurity-specialized LLMs. Its significance lies in three areas:

1. Enabling Robust SFT: The dataset allows for the training of models that understand the iterative, tool-grounded nature of security work, addressing the limitations of current RL-only or instruction-only approaches. It supports recipes for continued pretraining, SFT, DPO, and RLVR.
2. Threat Intelligence: The corpus serves as a passive threat-intelligence feed, enabling studies on CVE-to-weaponization latency, adversary infrastructure usage, and the evolution of attack tradecraft in the wild.
3. Systemic Risk and Architecture: The paper posits that the current reliance on remote, gated frontier models concentrates the world's offensive and defensive context in a few API providers, creating a single point of failure. The authors claim that the only configuration preserving both productivity and confidentiality is an on-premise, privately-hosted cybersecurity-specialized LLM. CAI Dataset is shaped specifically to make the training of such models practical, offering a path to resolve the tension between operator efficiency and data sovereignty.

The authors conclude that the dataset is not merely a training resource but a record of cybersecurity automation in progress, highlighting the urgent need for specialized, locally-hosted models to mitigate the systemic risks of centralized operator context.