Paper Walkthrough — Feyospace-v1: Seven People, 164k Trajectories, and a Cyber Model

A seven-person team pushed open-weight models to leading agentic cyber capability — not by scaling, but by building resettable executable environments and auditing 164,269 trajectories. A ground-up walkthrough of the design and its stated limits.

Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models

What the paper claims

The original title is "Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models" (arXiv:2609.08418, published 8 September 2026, Vera Praxis Lab). Use that title if you want to find or cite it yourself.

The abstract in plain terms: building capable cyber agents is usually framed as a question of model scale, but open-weight post-training — sharpening an already-released model afterwards — is bottlenecked more directly by the cost of executable environments, reliable supervision across many turns of work, and access to strong teacher models. The authors combine five named systems with a data engine, and run long-context supervised fine-tuning on the 164,269 trajectories that survived execution verification and evidence auditing. The three resulting checkpoints improve on their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across the pooled CTF suites. As of 1 September 2026, Feyospace-s1 reaches a verified success rate of 63.24% and ranks 10th on the official CyberGym leaderboard, while all three rank 1st among models at comparable parameter scales. (Abstract)

An analogy: build the problem set, not a smarter student

There are two ways to raise exam scores. Make the student sharper, or build a large problem set that grades itself. The first route is pretraining and scale, and it costs a fortune in compute. This paper takes the second.

"Grading" here does not mean comparing a string against a reference answer. It means building the software, running it, and observing programmatically whether the attack landed. For a vulnerability reproduction, that means confirming the same exploit triggers the intended fault on the vulnerable build and fails on the patched one (§3.2). The paper calls these graded problems environments, and requires them to be resettable rather than single-use.

First principles: what post-training actually does

Training a language model is a next-token guessing game. Show it a reference text one token at a time; when the probability it assigned is low, the loss is high. Nudge the parameters in the direction that lowers that loss — this is gradient descent. Supervised fine-tuning (SFT) is the same procedure with the reference text swapped for recordings of good behavior.

How far you nudge is the learning rate. The paper warms it up over the first 5% of training to $1\times10^{-5}$, then decays it on a cosine schedule to $5\times10^{-7}$ (§4.3). Why so tiny? Push the slider below and watch.

Five named systems — two of which were never used

This is the section where careful reading matters most.

• Choulea recovers the hidden reasoning traces some proprietary APIs return as encrypted blocks. Recovery rates were high (a weighted aggregate of 92.8% before the 21 August 2026 defensive update), yet the paper states plainly that the recovered traces were not used as SFT targets (§2.1) — budget, plus non-stationary distributions from one provider and structures consistent with a possible injected trap from another. The lesson the authors draw: a high recovery rate does not imply positive training value.
• SkyReal lowers teacher-sampling cost by tapping a gray-market supply of low-cost accounts. It was not used in the final training pipeline — it "did not meet our internal requirements" (§2.2).
• Hongzwang keeps constrained teacher rollouts productive despite refusals and API limits. Also excluded from the final pipeline (§2.3, Ethics Statement).
• PSBreakup and Kreator are the two that were actually used.

In other words, the headline result rests on the last two plus the data engine; the paper itself disclaims the contribution of the first three.

The two that worked

PSBreakup starts from an observation: Kimi K3's hosted API is substantially stronger on cyber tasks than its open-weight release, and the gap is much smaller in other domains. The authors hypothesise that MOPD or a related merging stage weakened that capability in the released checkpoint — supported by the fact that iterative prompt elicitation recovers a meaningful fraction of the missing behavior from unchanged weights. The capability is latent, not absent (§2.4). PSBreakup estimates how many behavioral domains the merged model effectively carries (12, 8, and 9 across three models) using bidirectional interference probes, synthesises one prompt-conditioned teacher per domain from the same frozen weights, then applies token-level reverse-KL distillation that pushes the target domain toward recovery while holding the others in place. The retention term is the point: target-only fine-tuning above 600B parameters may overcorrect, damage retained capability, or collapse.

Kreator addresses exploit (EXP) writing, where even the teacher models fail end to end and verified positives are too scarce to cold-start SFT. A human expert steps in only at the blocking moment, supplying the missing step — 3.6 intervention turns per environment on average. Leave that prompt in the trace, though, and the model learns to wait for outside help. So Kreator rewrites only the intervened turns into the teacher's own first-person reasoning, leaving the verified trajectory before and after untouched (§2.5).

The comparison on 55 V8 environments is the interesting part. Rewriting with a strong external model (GPT-5.6 Sol) produced 27 execution-verified exploits; letting the teacher rewrite its own turn produced 32; letting the downstream student (Qwen3.8-27B) rewrite in its own voice produced 31. The strongest standalone writer did not win. Compatibility with the surrounding trajectory, or with the student's distribution, mattered more.