Symbiotic for AI labs
Security for the models and agents you ship.
Train your models to find, fix, and exploit vulnerabilities with our cybersecurity RL environments. Ship your coding agent with security enforced in the generation loop, on the harness enterprises already run.
Cybersecurity RL environments for post-training frontier models
0+
Vulnerability classes, rebuilt in original applications across the main production languages and frameworks
0
Localization, remediation, and offensive security, in whitebox and blackbox modes
0bands
Easy, Medium, and Hard, calibrated on current frontier models and re-checked as new ones ship
01
Localization
From a symptom report, the model reads the full codebase, finds the defective decision, and explains why the existing check falls short.
02
Remediation
The model patches the code so the attack is refused and the legitimate workflow still works.
03
Offensive security
The model sees only a deployed target, with no source code, and has to land the full attack chain.
04
Whitebox builds the foundation
What a model learns from source code carries over to blackbox tasks: where to look, how to trace untrusted input, what an incomplete check looks like.
05
Broad coverage
Injection, access control and authentication, SSRF, deserialization, supply chain, business logic, race conditions, and prompt injection in web applications.
06
The languages that run production
JavaScript and TypeScript, Python, Java and Kotlin, C#, PHP, Go, Rust, WebAssembly, and Terraform, with their main frameworks.
Distilled from a production security harness
Symbiotic Code, our security harness, finds and fixes vulnerabilities in code written by AI coding agents. We run it on code we write ourselves and on open-source repositories, and build our environments from what it records. That closes the sim-to-real gap public sets leave open.
Defects agents actually write
The vulnerability patterns the harness sees coding agents introduce become the starting point for new environments.
Fixes that held
Patches the harness applied and re-verified inform what a correct fix looks like, so remediation verifiers reward real fixes.
Shortcuts we've already seen
Cosmetic fixes, patches to the wrong file and other shortcuts agents take in the harness become scripted cheats every verifier must reject.
Hard means hard for agents
What frontier agents still miss in real code shapes the Hard band.
Difficulty you can build a curriculum on
Your model will fail most Hard environments at first, and that is expected. As it trains on Easy and Medium, it builds the skills to start solving Hard ones, and every solve becomes a strong learning signal.
For early training, when the model has little security knowledge. Typical pattern: a missed branch in a middleware, a misleading validator.
Ship a coding agent enterprises can trust
Enterprises want AI coding with security enforced where the code is generated. Embed the Symbiotic security harness in your coding agent and offer it with your own models.
Guardrails first
Guardrails apply before generation, and every output is checked against them.
Verified in the loop
Code is scanned and remediated before it's returned.
Governed and observable
Every agent action runs under policy, in a sandbox, with an audit trail.
Model-agnostic
Built to run with the models you train.
Every environment ships as a standard Harbor task, with its own sandbox, verifier, and reference solution, ready for Harbor-compatible post-training libraries
Each one also ships with full documentation: the vulnerability, the intended solve, how the verifier scores, and the failure trajectories we recorded on it.
Talk to our research team