A cyber evaluation is a controlled assessment of how an AI system behaves in security-related tasks or scenarios. Researchers use it to measure whether a model can follow instructions, use tools, handle network access, or perform defensive and offensive actions under defined limits. The goal is not to “set it loose,” but to observe capability, safety, and failure modes inside a test boundary.
This matters because an evaluation can become a real security event if the harness is poorly contained. If the testbed has broad credentials, outbound network access, or links to live services, the model may interact with real systems during testing. Defenders use sequestered testbeds, network allowlisting, scoped permissions, and strict teardown procedures to keep the assessment isolated. In practice, cyber evaluations help teams find prompt-injection exposure, unsafe tool use, and escalation risks before deployment, while also proving whether containment controls actually work.