---
title: BypassGym: researchers test whether AI agents can write loaders that get C2 shellcode past real EDR, and even small models often can | ctxsec
url: https://ctxsec.com/items/arxiv-bypassgym-ai-agents-edr-evasion-benchmark-6-edrs-deepseek-flash-17-of-18
description: "A new benchmark runs real Windows endpoints with six EDR products in Proxmox VMs and asks an agent to write and compile a loader that runs supplied C2 shellcode without being blocked or killed, feeding detection results back to the agent. Testing five lightweight model backends against three payloads, the authors report that even simple models produce working submissions; DeepSeek-V4.1 Flash succeeded in 17 of 18 runs, and Bitdefender was the hardest product, letting only 5 of 15 runs through. An optional 'evasion knowledge skill' lets them compare with and without domain hints."
status: "research (arXiv:2611.13684 preprint, Nov 10, 2026; not peer reviewed; results are the authors' own)"
published: 2026-11-12
---

> A new benchmark runs real Windows endpoints with six EDR products in Proxmox VMs and asks an agent to write and compile a loader that runs supplied C2 shellcode without being blocked or killed, feeding detection results back to the agent. Testing five lightweight model backends against three payloads, the authors report that even simple models produce working submissions; DeepSeek-V4.1 Flash succeeded in 17 of 18 runs, and Bitdefender was the hardest product, letting only 5 of 15 runs through. An optional 'evasion knowledge skill' lets them compare with and without domain hints.

[← AI](/ai) · [markdown](/items/arxiv-bypassgym-ai-agents-edr-evasion-benchmark-6-edrs-deepseek-flash-17-of-18.md)

research (arXiv:2611.13684 preprint, Nov 10, 2026; not peer reviewed; results are the authors' own)

2026-11-12 7:40 AM ET

### BypassGym: researchers test whether AI agents can write loaders that get C2 shellcode past real EDR, and even small models often can

- **For defenders:** assume commodity agents can iterate on loaders against your EDR; prioritize behavior-based detections (memory allocation plus execution patterns, unusual parent-child chains, C2 beaconing) over static signatures.
- **Caveats:** small sample, lab settings and default EDR configurations; per-product results may not reflect tuned deployments.

Sources: [arXiv:2611.13684, BypassGym: A Benchmark for Evaluating AI Agents' Endpoint Defense Evasion Capabilities (Nov 10, 2026)](https://arxiv.org/abs/2611.13684)