Why does exploitation test multiple reasoning demands at once?

ExploitGym describes exploitation as a staircase rather than a single act. It starts from an initial vulnerability, for instance "a few-byte buffer overflow," progressively obtains stronger primitives and privileges such as arbitrary memory reads and writes, and ultimately causes a concrete security impact such as unauthorized file access or code execution. The benchmark mirrors that shape: given a program input that triggers a vulnerability, the agent is tasked with progressively extending it into a working exploit.

The paper names three demands that this staircase makes at once: low-level program reasoning (its example is memory layout), runtime adaptation, and sustained progress over long horizons. The interesting point is that they are bundled. Most agent benchmarks isolate one of these. A reasoning benchmark tests hard inference without an environment that pushes back; a tool-use benchmark tests interaction without deep domain reasoning; a long-horizon benchmark often gets its length from repetition. Exploitation gets its length from dependency: each primitive obtained is a precondition for the next, and the program's actual runtime behavior can invalidate a plan that looked sound on paper. The authors also credit exploitation with "diagnostic value," though the excerpt does not say why. My reading is that the bundling is the reason: failure at a given rung would say something specific about which of the three demands gave out.

That reading is my inference from the task structure, not something the excerpt demonstrates, because no per-stage results are included. But it connects to a pattern the vault already tracks. Do short benchmarks predict how models perform over long workflows? argues that length is its own axis on which models diverge; exploitation is a long-horizon task where the horizon is enforced by the causal chain, not by an instruction to keep going.

The scoring side complicates this. If the task is a staircase but success is scored only at the top, the diagnostic value of the intermediate rungs is left on the table — see Does arbitrary code execution alone capture exploit progress?.

The chain shape also appears on the containment side. The cyber-capable-agents review lists "multi-step offensive chains" among five vulnerability classes at the boundary between an agent and its evaluation environment (What vulnerabilities emerge where AI agents meet their evaluation sandbox?), and the excerpt gives the class a setting and no definition. Read as the same shape, which is the vault's reading and not the review's, the dependency that makes the task diagnostic is also something a containment design has to reckon with: each primitive obtained is a wider reach for the agent.