Frontier AI Models Favor Offense Over Defense in New Cyber Benchmark

The security community has spent years watching general-purpose large language models evolve from basic code assistants into capable vulnerability research engines. However, new benchmark data confirms what many defensive engineers have observed in practice: frontier AI models are dramatically better at attacking networks than defending them.

In a recent head-to-head evaluation conducted by AI security startup Corma, four leading frontier models—Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4—were pitted against one another as both attackers and defenders across simulated enterprise networks. Across 241 scored engagements, the attacking models successfully established persistence and implanted backdoors in 85% of their runs. In contrast, those same models acting as defenders managed to detect incoming intrusions just 19% of the time.

This stark asymmetry underscores an urgent challenge for modern security operations centers (SOCs): general foundation models inherently favor offensive workflows, creating an operational imbalance that defenders must deliberately bridge.

Benchmark Breakdown: 85% Attack Success vs 19% Detection

To measure the gap between offensive and defensive capability, researchers constructed complex, simulated enterprise network environments designed to mirror multi-business organizational structures. Each engagement assigned an AI model the role of an attacker attempting to establish persistent remote access, while a paired model acted as the network defender tasked with identifying, attributing, and stopping the breach.

Every model was tested against every other model—including self-play matches where a model defended against its own instance—across 15 independent engagements per pairing.

+-------------------------------------------------------------------+
|               FRONTIER MODEL ASYMMETRY BENCHMARK                  |
+-------------------------------------------------------------------+
|  Successful Backdoor Persistence (Attacker)  [==========]  85%    |
|  Successful Attack Detection (Defender)     [==        ]  19%    |
+-------------------------------------------------------------------+

The results highlight a recurring pattern in modern cyber operations: initial exploitation and lateral movement follow relatively deterministic paths, while detection demands high-context correlation across noisy environments. When acting offensively, the AI agents systematically identified unpatched vulnerabilities, executed chain exploits, and bypassed initial security controls to plant persistent backdoors. When tasked with defense, however, the models frequently overlooked subtle indicators of compromise (IoCs) and failed to correlate multi-stage attacker behavior.

Why Foundation Models Fail at Defensive Telemetry

The root cause of this asymmetry lies in training distribution and the fundamental difference between offensive and defensive reasoning.

Offensive security tasks closely align with standard language model training objectives. Finding a bug or constructing a payload relies on parsing source code or binary structures, executing tool-assisted API calls, and verifying a clear functional goal (e.g., getting a shell or writing a backdoor file to disk). The success condition is direct and feedback-driven: either the code executes and grants elevated privileges, or it fails.

Defensive security, by contrast, rarely revolves around inspecting neat source code. Blue teams operate in environments flooded with unstructured and structured machine telemetry:

• System and Application Logs: Windows Event Logs (Sysmon), Linux auditd, and application traces.
• Network Flow Data: NetFlow, IPFIX, and encrypted traffic metadata.
• Identity and Access Audit Trails: CloudTrail, Entra ID/Active Directory sign-in logs, and Okta event streams.
• On-Disk Artifacts: Volatile memory states, shimcache entries, and file creation timestamps.

Machine telemetry represents a minuscule fraction of the internet-scale text corpora used to pre-train base models. Furthermore, defensive analysis requires open-ended reasoning over long time horizons. Distinguishing an adversary’s living-off-the-land (LotL) commands—such as a malicious certutil download or unauthorized PowerShell execution—from legitimate administrator behavior requires deep context regarding an enterprise’s specific baseline, naming conventions, and deployment pipelines. Without custom alignment, generic models suffer high false-negative rates when processing raw event streams.

Operationalizing Autonomous Defensive Agents

To counter this mismatch, cybersecurity platforms are pivoting toward specialized defensive agents built specifically to parse structured operational data and automate threat containment.

Corma, which recently emerged with $60 million in seed funding led by Sequoia Capital alongside Khosla Ventures and Coatue, is developing specialized AI agent architectures engineered to function as autonomous SOC analysts. Rather than relying on static playbooks or manual analyst triage, these agents operate directly within customer environments across critical sectors like healthcare, finance, energy, and retail.

By fine-tuning models on domain-specific security logs and giving agents scoped action permissions, organizations are moving from passive alert generation to active containment. In one documented production event, a security executive was alerted via a smartwatch prompt generated by an autonomous defender agent. The agent had detected a live attack involving lateral movement across the internal network, identified the compromised process, and requested authorization to isolate the host and terminate the malware execution chain. Upon approval, the agent contained the intrusion in under ten minutes.

Early enterprise deployments demonstrate that domain-aligned defensive AI can reduce mean time to respond (MTTR) by more than 94% while expanding operational security coverage across multiple functional disciplines.

What Security Teams Should Take Away

As generative AI and agentic frameworks lower the bar for sophisticated, automated attack campaigns, defenders cannot assume off-the-shelf foundation models will automatically safeguard their estates. Security leaders should evaluate their current exposure and AI defense strategy:

1. Recognize the Threat of Autonomous Offense: Adversaries are leveraging frontier models to conduct rapid vulnerability research and orchestrate multi-step exploitation pipelines. Expect attack velocity to increase significantly.
2. Avoid Relying on Raw LLMs for Log Triage: Standard base models are poorly suited for raw SIEM/EDR log parsing out of the box due to context limitations and token distribution biases.
3. Implement Human-in-the-Loop Autonomous Response: Deploy specialized agentic security tools capable of correlating telemetry across identity, endpoint, and cloud environments, but maintain explicit approval gates for high-impact mitigation steps like host isolation and firewall rule modifications.