The 10-Level AI Cyber Capability Ladder: A Living Taxonomy of Autonomous Agent Capabilities

Taxonomy StandardHermes 10-Level Ladder
Current Frontier CeilLevel 4 to Level 5
Correlated TargetsLinux Kernel, V8, Web Apps
Verification MethodDeterministic Testbeds

1. The Capability Ladder Architecture

Treating cybersecurity capability as a binary outcome (“Can AI hack?”) obscures the procedural nature of security engineering. An agent that can spot an unescaped SQL parameter in a 20-line script is fundamentally distinct from an agent capable of bypassing address space layout randomization (ASLR) and kernel supervisor protections.

The Hermes Capability Ladder formalizes 10 discrete, verifiable rungs:

               THE HERMES 10-LEVEL AI CYBER CAPABILITY LADDER

  [LEVEL 10] Autonomous Multi-Stage Campaign (Enterprise Lateral Pivoting)  [HYPOTHETICAL]
  [LEVEL 09] Session Persistence & Active Post-Exploitation                 [EXPERIMENTAL]
  [LEVEL 08] Mitigation Evasion & Hardened RCE (Kernel / V8 Sandbox Escape) [UNRELIABLE / <5%]
  [LEVEL 07] Arbitrary Code Execution (ACE without Mitigations)             [LOW / ~12%]
  [LEVEL 06] Control-Flow Hijacking (Return Address / Function Pointer)     [MODERATE / ~28%]
  [LEVEL 05] Exploitation Primitive Synthesis (addrof / fakeobj / OOB)     [TRANSITIONAL / ~43%]
  [LEVEL 04] Proof-of-Vulnerability (PoV) / Crash Trigger Generation        [RELIABLE / ~71%]
  [LEVEL 03] Bug Reproduction from Advisory / Sanitizer Report              [HIGH / ~78%]
  [LEVEL 02] Unassisted Vulnerability Discovery (Source Code Audit)          [HIGH / ~78%]
  [LEVEL 01] Vulnerability Comprehension & Explanation                      [COMMODITY / ~95%]

2. Comprehensive Level-by-Level Specification

Level	Designation	Technical Verification Criteria	Benchmark Mapping	Frontier Pass Rate
L1	Vulnerability Comprehension	Accurately explains root cause and mechanics of known CVEs	SecCode, CVE-Bench	94.8%
L2	Vulnerability Discovery	Locates exploitable CWEs in multi-file source repositories	CyberGym, Semgrep AI	78.5%
L3	Bug Reproduction	Instantiates target in container and triggers deterministic fault	CyberGym, SRE-Bench	76.4%
L4	PoC / Trigger Generation	Generates valid input triggering unhandled exception or crash	ExploitGym (PoV phase)	71.4%
L5	Primitive Synthesis	Obtains arbitrary read/write, fakeobj, or heap corruption primitives	ExploitBench (T5–T8)	42.8%
L6	Control-Flow Hijacking	Redirects instruction pointer ($rip) or overwrites function pointers	ExploitBench (T9–T11)	28.2%
L7	Arbitrary Code Execution	Executes unauthenticated shellcode with ASLR/DEP disabled	ExploitGym (Userspace)	12.4%
L8	Mitigation Evasion & RCE	Bypasses ASLR, DEP, and CFI to achieve remote code execution	ExploitGym (Kernel/V8)	4.9%
L9	Session Persistence & Post-Ex	Establishes C2 beacon, harvests credentials, and maintains access	Inter-Agent Benchmarks	1.8%
L10	Autonomous Multi-Stage Campaign	Conducts recon, weaponization, and lateral movement across AD	Cyber-Range Emulation	0.0%

3. The Great Capability Chasm: Level 4 vs. Level 5

The critical boundary in autonomous cyber operations lies between Level 4 and Level 5:

Level 4 (Commodity Triggering): Creating an input that triggers an unhandled memory fault, denial of service, or basic SQL error requires shallow logical reasoning. Frontier models execute this reliably (71.4% pass rate).
Level 5 (Primitive Engineering): Weaponizing that crash into controlled arbitrary memory read or write primitives requires modeling complex dynamic heap state, pointer alignments, and cache lines. Beyond this point, agent success drops sharply to 42.8% and collapses under compiler mitigations.

                     THE LEVEL 4 TO LEVEL 5 CHASM

  [LEVEL 1 - 4: PRE-COMPILATION & PARSING]
  High Reliability (71% - 95%)
  • Semantic code review
  • Bug triage & PoV trigger creation
  • Fuzzing seed mutation
  ══════════════════════════════════════════════════════════════ <--- THE STRUCTURAL WALL
  [LEVEL 5 - 10: DYNAMIC STATE & SYSTEM EXPLOITATION]
  Low Reliability (0% - 42%)
  • Heap grooming & address leaks
  • ROP chain construction
  • ASLR / CFI bypass
  • Multi-host lateral movement

4. Mapping Real CVEs to Ladder Milestones

To anchor the taxonomy in production security history:

CVE-2024-47575 (FortiManager Missing Auth): Demonstrates Level 4/7 capability—trivial protocol trigger yields direct command execution due to absent authentication checks.
CVE-2024-21762 (FortiOS Out-of-Bounds Write): Demonstrates the Level 5/8 barrier—heap corruption requires precise memory grooming to overcome SSL VPN process mitigations.
CVE-2024-0519 (Google Chrome V8 Out-of-Bounds Memory Access): Demonstrates the Level 5 primitive frontier—models can trigger the out-of-bounds access but fail to synthesize functional addrof primitives under V8 sandbox constraints.

5. Strategic Defense Implications

Prioritize Runtime Mitigations Over Input Filtering: Because agents excel at Level 1–4 discovery, application developers cannot rely on obscure code paths. Enabling compiler hardening (ASLR, Full RELRO, Stack Canaries, CFI) drops agent exploitation success from 78% to under 5%.
Automating Defensive Parity: Security teams must match attackers at Level 1–4 by deploying static-analysis and fuzzing agents in continuous integration pipelines, eliminating flaws before public disclosure.

What Can AI Agents Do in Cybersecurity in 2026? The Master Pillar page mapping empirical capabilities across all 11 security domains.

ExploitBench: 16-Stage Capability Ladder Deep dive into the 16-rung exploit engineering ladder on hardened Google V8 targets.

ExploitGym: Real Vulnerability Exploitation Measuring autonomous agents against 300 real CVEs across userspace and kernel runtimes.

Editorial Strategy & Scoring Rubric The foundational scoring rubric and empirical research standards.