# NeuralSyncLabs

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Habib N](https://cerebralvalley.ai/u/Habib0x)
- **GitHub:** https://github.com/Habib0x0/musearena
- **Demo video:** https://youtu.be/r4D9djKnZF8
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2813

MuseArena: AI red team against AI blue team in a real virtual company. Every attack is on the record.

The problem

Security teams cannot safely practice against real attacks. There is also almost no realistic, labelled data to train red and blue security models. Live tests are dangerous. Tabletop exercises are not real. Most agent tests do not compare the claims of the agent with the real events.

How it works

You write a description of an organization in plain English, for example a 12-person clinic. MuseArena builds the organization as real virtual machines (VMs). The VMs are a gateway with DNS, a directory server, a mail server, an intranet, a patient database and a log collector. The system configures each VM through SSH. Each VM must pass readiness checks and sensor tests before the exercise starts.

Then Meta models operate the organization:

  - Employees: Muse Glimmer 30B operates 8 AI employees. Each employee does only the actions on an approved list.
  - Red team: Muse Spark Open attacks from its own VM. Rules of engagement keep the red team in the lab. Each attack step has a MITRE ATT&CK technique ID.
  - Blue team: Muse Spark Open reads the same logs that a real security team reads. For each accusation, the blue team must identify the log rows that show the attack.

The agents do not score their own work

  - Red team: it gets points only with proof. The system puts a random value on each target, and the red team gets points only when it sends this value back.
  - Blue alerts: an alert counts only when a Sigma detection rule also finds the attack in the logs.
  - Responses: a response, for example "block an IP address" or "isolate a host", counts only after the system applies it on the network and then checks it.

Each step becomes an agent trajectory. The trajectory records what the agent saw, what the agent did and what really occurred. Each run gives a dataset with a content hash. You can replay the dataset and score it again without the VMs. You can use the dataset to train your own red and blue models.

A real recorded run

The red team attacked the web server first, and this attack failed. Then the red team tried many passwords and found a weak database password. With this password, the red team got the proof value. The blue team found command-injection attempts in the web logs. The blue team identified the log rows and blocked the IP address of the attacker. A Sigma rule confirmed the alert, the system applied the block on the network, and there were 0 false positives. The run recorded 251 verified steps.

## More from Meta Global AI Developer Hackathon

- [Raveenthecoder](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2810)
- [VRON](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2811)
- [Agent Rizz](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2812)
- [Physics Proof](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2814)
- [Commonplace](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2815)
- [QTP](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2816)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2813. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt