Stardust Flash-01
How Flash-01 was trained
From security research to reinforcement learning.
The pipeline#
- Discovery: Stardust finds vulnerabilities through reviews, scans and investigations of software and protocols.
- Environments: production-like gyms recreate the behavior, roles and system interactions that matter.
- Vulnerabilities: validated findings are moved into isolated training environments.
- Difficulty: exploit chains are tuned against the information the agent has to work with.
- Reinforcement learning: the model trains on agent trajectories with verified target outcomes.
- Evaluation: performance is measured on held-out environments.
One case, three views#
The first training run used 150 tasks built from 50 vulnerability cases. Each case comes in three views with a different amount of information:
| View | What the agent gets |
|---|---|
| Guided whitebox | Full source code plus detailed guidance on the vulnerability and exploit path. It still has to pull off a working exploit. |
| Focused whitebox | Full source code with only light direction toward a subsystem. |
| Focused blackbox | Limited direction and access to the running target, no source code. |
Case composition#
| Category | Share of the 50 cases |
|---|---|
| Access control, identity & scope | 72% |
| Accounting & number precision | 18% |
| Time checks & signature reuse | 4% |
| Business logic & payment checks | 4% |
| Server-side request forgery (SSRF) | 2% |
Anatomy of a training case#
Each case is a small, realistic deployment: a pinned app release with one planted flaw, populated with believable data and reset before every attempt. The agent works from its own sandbox with a brief, a toolkit and limited access. A verifier it can't see checks the end state and gives a pass or fail. Passing runs get a second look, so a case won through a shortcut is sent back for repair.
Why difficulty matters#
GRPO compares results across a group of attempts on the same task. If every attempt passes, or every attempt fails, there is nothing to learn from. Cases the model solves only some of the time give the useful signal, so difficulty is matched to what the model can do today while keeping the investigation real.
Example: artifact isolation in Forgejo#
The agent had access to one running workflow; a second workflow held an artifact it was not allowed to see. The planted flaw: the signed download URL left out part of the workflow context the app later uses to pick which artifact to serve. The agent linked the two and recovered the protected artifact, which the verifier confirmed.