Hephaestus: Toward a Cybersecurity AI Scientist
For cybersecurity researchers, this paper offers a conceptual framework and agenda for automating cyber research, but it is purely architectural with no implementation or validation.
The paper defines the concept of a Cybersecurity AI Scientist, arguing that AI-native cybersecurity requires a new scientific object due to its non-stationary substrate and evaluation via digital twins. It proposes a modular multi-agent architecture and a four-zeros evaluation frame, but provides no empirical results or concrete numbers.
Cyber offense is moving to machine speed; cyber research itself is not. Existing AI scientist systems make end-to-end research automation increasingly plausible, but they target relatively stable scientific domains. We argue that AI-native cybersecurity is a different kind of scientific object. Its recurring units of study are security events and interaction traces, not static assets; its model and tool substrate is non-stationary, not steady-state; and credible evaluation depends on digital twins, cyber ranges, and auditable evidence rather than on a single benchmark score. We call this object the Cybersecurity AI Scientist. A practical realization is a modular, role-specialized multi-agent research system that coordinates problem framing, threat modeling, tool generation, controlled experimentation, evaluation, governance, and scientific reporting, and that anchors its concrete objectives in a four-zeros frame spanning risk, trust, incident, and energy dimensions. As a representative agenda we focus on AI-native defense, where steady-state perimeters give way to resilient agent legions and the classical category of terminal security is itself being deconstructed into agent security. This paper defines the object, separates it from any single organizational realization, and offers an architecture and an agenda on which later systems, benchmarks, and empirical programs can be built.