Uri Rolls is a co-founder of Arithmetic, an AI cybersecurity company building interactive cybersecurity benchmarks and training data for more capable automated defenders. His central concern is that advanced models can identify vulnerabilities and gather clues without understanding how permissions, identities, and interconnected systems change during an attack.
Before Arithmetic, Rolls studied at Harvard and founded The Camel, an entrepreneurial community connecting Harvard and MIT students. He also led astronomical-imaging research that applied Gaussian processes and Kalman filtering to atmospheric distortions affecting Event Horizon Telescope observations, testing the approach against measurements of the blazar 3C 279.
At AI Engineer World’s Fair 2026, where he appeared as Arithmetic’s chief executive, Rolls introduced the company’s cybersecurity work alongside Hugging Face co-founder Thom Wolf. Arithmetic’s premise is that AI changes the economics of security: attackers can probe more targets simultaneously, while defenders must protect entire environments with limited human intervention. Rolls wants models capable of defending those environments at comparable speed and scale.
- Mask Off benchmark. Arithmetic’s first benchmark targets broken access control, using vulnerabilities discovered by human security researchers to construct live environments linking real applications. Models receive ordinary security tools but no source code, internet access, or advance knowledge of the underlying flaw.
- Deterministic exploit grading. Each stage of a multistep attack can be verified separately, revealing whether a model discovered useful information, understood its significance, or successfully escalated privileges. That intermediate feedback exposes reasoning failures that a simple pass-or-fail score conceals.
- Reasoning across changing permissions. One scenario connects Keycloak, Vault, and an intermediary service. An inconsistency between authorization checks based on names and identifiers creates a privilege-escalation path, but exploiting it requires understanding how changing one identity affects permissions elsewhere. Rolls uses such tasks to test whether models can maintain a working picture of a system as their own actions transform it.
- Open-source cyberdefense. Rolls advocates capable open models that defenders can post-train for particular networks and operational environments. His goal is a security stack built around specialized, fast-moving AI defenders, supported by realistic evaluations and high-quality cybersecurity training data.
His World’s Fair session with Thom Wolf captures the practical ambition behind Arithmetic: turn difficult, human-discovered security problems into measurable improvements in model reasoning.
