# US 12,739,272 B2 · Cybersecurity vulnerability detection with artificial intelligence models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,739,272 B2 - Document ID: US12739272B2 - Status: Granted - Kind: B2 - Application number: 18/753,724 - Filed: 2024-06-25 - Published: 2025-12-25 - Granted: 2026-09-15 - Earliest claimed: 2024-06-25 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: Ian Torres; Alexander Nazarian; Arnd Korn - Web page: https://patentgrep.com/patent/US12739272B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04W 24/02: Arrangements for optimising operational condition - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure provides techniques for red teaming with artificial intelligence (AI) models. A processing device generates, via a first AI model, an agent action space based on security data, where the agent action space is indicative of actions to perform to potentially compromise at least one of a computing system, a network, or an application. The processing device performs a reinforcement learning process with an agent based on the agent action space to obtain a log of the reinforcement learning process. The processing device generates, via a second AI model, a report based on the security data and at least a portion of the log, where the report is indicative of a security weakness of the at least one of the computing system, the network, or the application. ## Claims ### Claim 1 A method, comprising: generating, via a first artificial intelligence (AI) model, an agent action space based on security data, wherein the agent action space is indicative of actions to perform to potentially compromise at least one of a computing system, a network, or an application; performing a reinforcement learning process with an agent based on the agent action space to obtain a log of the reinforcement learning process, wherein performing the reinforcement learning process comprises determining a policy based on the agent action space and a reward function, wherein the log of the reinforcement learning process is based on the policy, and wherein the log includes parameters of the reinforcement learning process; and generating, by a processing device and via a second AI model, a report based on the security data and at least a portion of the log, wherein the report is indicative of a security weakness of the at least one of the computing system, the network, or the application. ### Claim 2 (depends on 1) The method of claim 1, wherein the security data comprises at least one of: a cybersecurity intelligence report; cybersecurity associated code from a code repository; or a support ticket. ### Claim 3 (depends on 1) The method of claim 1, wherein the first AI model is trained to generate agent action spaces, and wherein the second AI model is trained to generate reports. ### Claim 4 (depends on 1) The method of claim 1, wherein the report comprises at least one of an indication of a subset of the actions that lead to the security weakness, observations corresponding to the subset of the actions, or recommendations for mitigating the security weakness. ### Claim 5 (depends on 1) The method of claim 1, wherein the agent action space indicates an action that potentially compromises the at least one of the computing system, the network, or the application and metadata for the action. ### Claim 6 (depends on 1) The method of claim 1, wherein the security weakness comprises a gap or a vulnerability in the at least one of the computing system, the network, or the application. ### Claim 7 (depends on 1) The method of claim 1, further comprising: outputting the report, wherein outputting the report comprises at least one of transmitting the report or storing the report. ### Claim 8 (depends on 1) The method of claim 1, wherein the actions comprise at least one of a tactic that describes an objective, a technique that describes how the objective is achieved, or a procedure that describes an implementation of the tactic. ### Claim 9 (depends on 1) The method of claim 1, wherein generating the agent action space comprises providing the security data as a first input to the first AI model and obtaining the agent action space as a first output of the first AI model, and wherein generating the report comprises providing the at least the portion of the log and the security data as a second input to the second AI model and obtaining the report as a second output of the second AI model. ### Claim 10 (depends on 1) The method of claim 1, wherein the first AI model comprises a first large language model (LLM) and the second AI model comprises a second LLM. ### Claim 11 (depends on 1) The method of claim 1, wherein the actions include first actions and second actions, wherein the first actions are indicated by the security data, and wherein the security data is devoid of the second actions. ### Claim 12 (depends on 1) The method of claim 1, wherein generating the agent action space comprises generating code corresponding to the actions via the first AI model, and wherein performing the reinforcement learning process comprises executing the code in an environment. ### Claim 13 (depends on 1) The method of claim 1, further comprising: processing the security data to obtain a first prompt, wherein generating the agent action space via the first AI model is based on the first prompt; and processing the log and the security data to obtain a second prompt, wherein generating the report via the second AI model is based on the second prompt. ### Claim 14 A system, comprising: a memory; and a processing device, operatively coupled to the memory, to: generate, via a first artificial intelligence (AI) model, an agent action space based on security data, wherein the agent action space is indicative of actions to perform to potentially compromise at least one of a computing system, a network, or an application; perform a reinforcement learning process with an agent based on the agent action space to obtain a log of the reinforcement learning process, wherein performing the reinforcement learning process comprises determining a policy based on the agent action space and a reward function, wherein the log of the reinforcement learning process is based on the policy, and wherein the log includes parameters of the reinforcement learning process; and generate, via a second AI model, a report based on the security data and at least a portion of the log, wherein the report is indicative of a security weakness of the at least one of the computing system, or the network. ### Claim 15 (depends on 14) The system of claim 14, wherein the security data comprises at least one of: a cybersecurity intelligence report; cybersecurity associated code from a code repository; or a ticket. ### Claim 16 (depends on 14) The system of claim 14, wherein the report comprises at least one of an indication of a subset of the actions that lead to the security weakness, observations corresponding to the subset of the actions, or recommendations for mitigating the security weakness. ### Claim 17 A non-transitory computer-readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to: generate, via a first artificial intelligence (AI) model, an agent action space based on security data, wherein the agent action space is indicative of actions to perform to potentially compromise at least one of a computing system, a network, or an application; perform a reinforcement learning process with an agent based on the agent action space to obtain a log of the reinforcement learning process, wherein performing the reinforcement learning process comprises determining a policy based on the agent action space and a reward function, wherein the log of the reinforcement learning process is based on the policy, and wherein the log includes parameters of the reinforcement learning process; and generate, by the processing device and via a second AI model, a report based on the security data and at least a portion of the log, wherein the report is indicative of a security weakness of the at least one of the computing system, the network, or the application. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the first AI model comprises a first large language model (LLM) and the second AI model comprises a second LLM. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the actions include first actions and second actions, wherein the first actions are indicated by the security data, and wherein the security data is devoid of the second actions. ### Claim 20 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the security data comprises at least one of: a cybersecurity intelligence report; cybersecurity associated code from a code repository; or a ticket.