{"id":"https://openalex.org/W7224958377","doi":"https://doi.org/10.5281/zenodo.23800227","title":"Who Wins the Window? Agentic Vulnerability-Response Benchmarks Measure Model Competence, Not Vulnerability Difficulty","display_name":"Who Wins the Window? Agentic Vulnerability-Response Benchmarks Measure Model Competence, Not Vulnerability Difficulty","publication_year":2026,"publication_date":"2026-10-30","ids":{"openalex":"https://openalex.org/W7224958377","doi":"https://doi.org/10.5281/zenodo.23800227"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.23800227","doi":"https://doi.org/10.5281/zenodo.23800227","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23800227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.23800227","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139939055","display_name":"Tao An","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"An, Tao","raw_affiliation_strings":["FIM Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FIM Labs","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5139939055"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8945000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8945000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0786999985575676,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.011599999852478504,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/language-model-agents","display_name":"language model agents","score":0.628000020980835},{"id":"https://openalex.org/keywords/measurement-validity","display_name":"measurement validity","score":0.5389999747276306},{"id":"https://openalex.org/keywords/security-advisories","display_name":"security advisories","score":0.31200000643730164}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.697700023651123},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6050999760627747},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.47540000081062317},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.4690999984741211},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.42309999465942383},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.41600000858306885},{"id":"https://openalex.org/C100521375","wikidata":"https://www.wikidata.org/wiki/Q2015382","display_name":"Competence (human resources)","level":2,"score":0.37229999899864197},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.36739999055862427},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.3659999966621399},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3605000078678131},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.32670000195503235},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.3100999891757965},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.2922999858856201},{"id":"https://openalex.org/C89992363","wikidata":"https://www.wikidata.org/wiki/Q5961558","display_name":"Track (disk drive)","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C2776927521","wikidata":"https://www.wikidata.org/wiki/Q468489","display_name":"Pursuer","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C100368936","wikidata":"https://www.wikidata.org/wiki/Q1411725","display_name":"Crawling","level":2,"score":0.26829999685287476},{"id":"https://openalex.org/C30038468","wikidata":"https://www.wikidata.org/wiki/Q4354775","display_name":"Memorization","level":2,"score":0.267300009727478}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.23800227","doi":"https://doi.org/10.5281/zenodo.23800227","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23800227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.23800228","doi":"https://doi.org/10.5281/zenodo.23800228","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23800228","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.23800227","doi":"https://doi.org/10.5281/zenodo.23800227","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23800227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7221776666","https://openalex.org/W7133506238","https://openalex.org/W3083273730","https://openalex.org/W7214712591","https://openalex.org/W7224815732","https://openalex.org/W4411120547","https://openalex.org/W7223928503","https://openalex.org/W7128071966","https://openalex.org/W7214726965","https://openalex.org/W7220747706"],"abstract_inverted_index":{"A":[0],"measurement-validity":[1],"study":[2],"of":[3,56,60,120],"agentic":[4],"CVE":[5],"benchmarks.":[6],"Given":[7],"a":[8,12,17,22,26,32,54,70,77,108,115],"public":[9,110],"advisory":[10],"and":[11,69,97,126,145],"patch":[13],"diff,":[14],"we":[15],"measure":[16],"'defender":[18],"window':":[19],"how":[20],"fast":[21],"language-model":[23],"agent":[24],"gets":[25],"deployable":[27],"defense":[28],"in":[29,141],"place":[30],"versus":[31],"working":[33,147],"reproducer,":[34],"over":[35],"nine":[36],"patched":[37,138],"N-day":[38],"web":[39],"vulnerabilities.":[40],"Across":[41],"four":[42],"models":[43],"the":[44,51,57,61,80,85,104],"deployable-defense":[45],"rate":[46],"spans":[47],"0.15":[48],"to":[49,107],"0.76;":[50],"ordering":[52],"is":[53,75,149],"property":[55],"model,":[58],"not":[59,76,102],"CVE.":[62],"The":[63],"gap":[64],"survives":[65],"two":[66],"scorer":[67],"relaxations":[68],"gate-threshold":[71],"sweep,":[72],"so":[73,88],"it":[74,92],"scoring":[78],"artifact;":[79],"sole":[81],"model":[82,124],"that":[83,114],"favors":[84],"defender":[86],"does":[87,101],"only":[89],"on":[90],"CVEs":[91],"can":[93],"recall":[94],"from":[95],"memory;":[96],"laboratory":[98],"reproduction":[99],"cost":[100],"track":[103],"real-world":[105],"delay":[106],"first":[109],"exploit.":[111],"We":[112],"argue":[113],"defensively":[116],"framed":[117],"window":[118],"metric":[119],"this":[121],"kind":[122],"confounds":[123],"competence":[125],"memorization":[127],"with":[128],"vulnerability":[129],"difficulty.":[130],"Pilot":[131],"scale":[132],"(n=9":[133],"CVEs);":[134],"all":[135],"vulnerabilities":[136],"are":[137],"N-days":[139],"exercised":[140],"local":[142],"isolated":[143],"containers,":[144],"no":[146],"exploit":[148],"released.":[150]},"counts_by_year":[],"updated_date":"2026-11-01T11:40:01.658920","created_date":"2026-10-31T00:00:00"}