Wiz Cyber Model Arena v3.9 (Websec.fr CTFs)

The web security category of Wiz's Cyber Model Arena v3.9 (Web Sec on the leaderboard): 29 capture-the-flag challenges from the public websec.fr site, in which an agent reads the PHP source a challenge exposes and writes a working exploit to capture its flag. Wiz notes that websec.fr is a known corpus, so isolation stops lookups but not recall from training. Pass@1 averages three attempts per challenge, for a model in a general-purpose harness.