About BB Arena
BB Arena is an independent benchmark that measures how well AI models, working as autonomous agents, find and exploit real web and API vulnerabilities from the outside, and whether they can prove it.
Who builds it
Marius du Preez
Full-time security researcher · MDP SEC
Finds vulnerabilities in web apps and APIs, focused on access control and business logic. Every lab in BB Arena is built from his own security research.
- Reports submitted
- 582
- Critical
- 148
- High
- 263
- Bug-bounty platforms
- 5
From mdpsec.com, as of October 2026
Where the labs come from
All 100 labs were built from Marius du Preez's own security research. Each one recreates the attack path behind a real-world vulnerability: how an attacker gets there and what it gives them. The labs themselves are fully synthetic and written from scratch, with no real organisation names, domains, credentials, customer data or code.
Why it exists
AI agents are already being used for real security testing, but most cyber benchmarks hand the model source code or reuse public challenges that may already be in its training data. BB Arena was built to answer a practical question: which models can actually do black-box testing against real-world bugs, how far do they get, and what does it cost? The full methodology explains how every result is produced.
Get in touch
Model vendors, researchers and press: see the contact page.