Cybersecurity AI (CAI), the framework for AI Security
[!IMPORTANT] ** This repository is archived.**
CAIis no longer under active development. This branch holds the complete final source tree, read-only, as a research artifact — the reference implementation behind a body of work spanning 18 papers, 30+ CVEs and #1 rankings in international security competitions.The repository has been consolidated into a single archival commit. Nothing of the source is missing: every file of the final release is here, and the published packages, issues and pull requests remain available (see Where the source lives).
No further releases, bug fixes, security patches or support will be provided.
Everything CAI proved, and everything two years of open development taught us, has been carried forward into Cybersecurity Superintelligence (CSI).
[!NOTE] Existing CAI professional (paid) customers — you are not stranded.
We recommend migrating to CSI, where all CAI capabilities, fixes and defenses now live. If CSI is not the right fit for your deployment, write to [email protected] to discuss extended support for your existing CAI installation. Subscriptions, active or lapsed, are handled case by case — reach out before this archive becomes a problem for you.
Cybersecurity AI (CAI) was a lightweight, open-source framework for building and deploying AI-powered
offensive and defensive security automation. Released in April 2025 by
Alias Robotics, it became the de facto open framework for AI Security —
used by thousands of researchers and hundreds of organizations, and the experimental platform on which
the Cybersecurity AI research domain was established.
| Last open-source release | 0.5.10 — public PyPI cai-framework, December 2025 |
| Last professional release | v1.1.5 — paid customers only, private Alias Robotics package index (this tree) |
| Development span | March 2025 → August 2026 · 1,078 commits by 103 authors†, consolidated into one archival commit |
| Community | ~9.8k stars · ~1.4k forks · 275 issues · 195 pull requests |
| Research output | 18 papers and technical reports on Cybersecurity AI |
| Disclosure record | 30+ CVE IDs · 2 CISA ICS advisories · 100+ robot vulnerabilities |
| Competition record | Rank #1 at Neurogrid, Dragos OT and HTB "AI vs Humans" |
| Successor | Cybersecurity Superintelligence (CSI) |
† includes authors inherited from the upstream openai-agents-python history
The archive · CSI · The research · Funding · Using the archive · Citation · Acknowledgements · ⚖️ License
Frozen, not deleted. Everything stays readable.
| ✅ Still available | ❌ No longer provided |
|---|---|
Complete final source tree (v1.1.5), read-only |
Releases, bug fixes, security patches |
cai-framework 0.5.10 on public PyPI |
Issue triage, PR review, roadmap |
| Documentation and examples as of the final release | Support of any kind, community or commercial |
| Issues · PRs as a public record | Browsable commit-by-commit history |
| All papers, datasets and benchmarks | alias model access through this framework |
Published cai-framework releases on PyPI |
Guarantees about third-party model providers |
This repository was squashed to a single commit when it was archived, so the incremental history is no longer browsable here. The code itself is fully intact and remains available in several forms:
| What | Where |
|---|---|
Final source tree — every file of the last professional release (v1.1.5) |
this branch |
Open-source releases — 0.3.9 through 0.5.10, each with its own sdist and wheel |
cai-framework on PyPI |
| Development record — 275 issues and 195 pull requests, with their diffs and discussion | Issues · Pull requests |
| Documentation as of the final release | docs/ · aliasrobotics.github.io/cai |
| Research artifacts — papers, benchmarks, datasets | aliasrobotics.com/research-security.php |
If you need something from the pre-archival history for research or compliance reasons, write to [email protected].
[!WARNING] An archived offensive-security framework is unmaintained attack tooling. Dependencies will age, provider APIs will drift, and known weaknesses — including the prompt-injection classes we ourselves documented — will not be fixed here. Run it only in isolated environments, against systems you are explicitly authorised to test, and never as part of a production security programme.
Six layers. One product. Built for professionals.
Cybersecurity Superintelligence (CSI) is CAI's evolution into an enterprise product. Where CAI was an open research framework — free, best effort, and built to prove what agentic security could do — CSI is a commercially supported, licensed platform for professional security teams, enterprises, critical infrastructure operators, defense and government customers.
CAI survives inside it as the scaffold layer, now one of several harnesses, wrapped in the proprietary models, datasets, agents, steering and benchmarking CAI never had — and delivered with the support, licensing and sovereignty guarantees that production and national-security use require.
| Layer | What it leverages |
|---|---|
| LLMs | The alias family (alias3, alias2, alias2-mini, alias1, alias0) — cybersecurity-specialised, on-premise deployable |
| Scaffolds | Unified routing across Claude Code, Codex, Mistral, CAI and GCAI through a local proxy owning telemetry and cost |
| Datasets | 18.07 TB of expert security trajectories — 26M prompts, 230,935 sessions, 123 countries (arXiv:2605.28146) |
| Agents | 15+ specialised agents — Defender, Red Team, APT, Forensics, Robot Defender, custom |
| ️ Steering | Activation steering and abliteration, cutting refusals on legitimate offensive tasks from 59% to 1% |
| Benchmarking | Continuous measurement through Cybench and CAIBench |
Two years of open development produced a precise inventory of what an agentic security framework gets wrong — most of it visible in our issues and pull requests. CSI is the answer to that inventory.
| ️ Maintained injection defenses | CAI's four-layer guardrail framework (arXiv:2508.21669) was a research contribution. In CSI it is a supported, continuously updated control — agentic attack surface does not hold still. |
| A supported release train | Bug fixes and versioned releases, instead of a frozen archive (0.5.10 open source, v1.1.5 professional). |
| Professional support | Included with every tier, plus quarterly consulting on agent design, measurement and reporting on annual plans. |
| Sovereignty by construction | The CAI Dataset paper showed operators routinely paste live credentials and production hostnames into frontier-model APIs, concentrating the world's offensive context in a handful of providers. CSI's answer: on-premise, privately-hosted, cybersecurity-specialised models inside your trust boundary. |
| Enterprise & sovereign deployment | Commercial licensing, GDPR/NIS2 compliance, fully air-gapped installations, private benchmarking, audit logging and custom fine-tuning. |
| Multi-scaffold coverage | No single harness dominates. CSI's blackboard architecture composes heterogeneous scaffolds to solve 19/33 Cybench challenges vs 15/33 for the best individual scaffold (arXiv:2605.28334). |
One framework. Eighteen papers. A new research domain.
CAI was never only a tool. It was the instrument through which Cybersecurity AI was established as a research domain — a testbed for questions about autonomy, evaluation, strategy, defense and regulation that could not be answered on paper alone.
The framework is archived. The research is the lasting contribution, and it continues.
Full curated index → aliasrobotics.com/research-security.php
…Documented end-to-end in Towards Cybersecurity Superintelligence: from AI-guided humans to human-guided AI.
| Paper | What it established |
|---|---|
CAI: An Open, Bug Bounty-Ready Cybersecurity AIarXiv:2504.06017 · Apr 2025 · HTML edition |
The framework paper. 3,600× faster than human pentesters at 156× lower cost; CVSS 4.3–7.5 findings in production systems; systematic evaluation across proprietary and open-weight LLMs, exposing the gap between vendor claims and measured capability. |
The Dangerous Gap Between Automation and AutonomyarXiv:2506.23592 · Jun 2025 |
A 6-level taxonomy separating automation from autonomy in Cybersecurity AI — the vocabulary the field was missing. |
CAI Fluency: A Framework for Cybersecurity AI FluencyarXiv:2508.13588 · Aug 2025 |
Educational framework and curriculum for cybersecurity AI literacy, developed with academic partners. |
Towards Cybersecurity SuperintelligencearXiv:2601.14614 · Jan 2026 |
Synthesises PentestGPT → CAI → G-CTR into a single trajectory: from AI-guided humans to human-guided AI. |
| Paper | What it established |
|---|---|
Evaluating Agentic Cybersecurity in Attack/Defense CTFsarXiv:2510.17521 · Oct 2025 |
54.3% defensive patching success against 28.3% offensive initial access — defense is, for now, the easier side for agents. |
CAIBench: A Meta-Benchmark for Cybersecurity AI AgentsarXiv:2510.24317 · Oct 2025 · HTML edition |
Modular meta-benchmark spanning Jeopardy CTFs, A&D CTFs, cyber ranges, knowledge and privacy — measuring labor-relevance, not trivia. |
| **[The World's Top AI Agent for Secu |
No open issues yet, or sync has not completed.