Cybersecurity AI (CAI) Dataset (arxiv.org)

The newly introduced Cybersecurity AI (CAI) Dataset represents a significant advance in the landscape of AI-powered cybersecurity tools. This extensive dataset consists of 230,935 session logs and over 26 million user prompts gathered from 16,768 source IPs across 123 countries, amassed over a fourteen-month period. By focusing on operator trajectories rather than merely model capabilities, the CAI Dataset highlights a critical bottleneck in cybersecurity LLM performance. The data includes a diverse mix of offensive, attacker-intent, and defensive interactions, making it the largest documented corpus of LLM-driven hacker activities to date. This dataset holds substantial implications for the AI/ML community, particularly by underscoring the operational realities of cybersecurity. As operators frequently input sensitive information such as live credentials and tokens into prompts—accepting the risks for competitive advantage—the CAI Dataset raises concerns about the concentration of cybersecurity knowledge within a few key model providers, which could lead to vulnerabilities at a national or enterprise level. To counter these risks, the dataset advocates for on-premise, cybersecurity-specialized LLMs, which ensure that productivity is maintained while keeping sensitive information secure within operators’ trust boundaries.