PHANTOM

Most cybersecurity benchmarks test what an agent knows; PHANTOM tests whether it can still think while being gaslit. Three autonomous agents play a closed co-evolutionary loop (TriPlay-RL): an RL Attacker generates deceptive SIEM logs turn-by-turn using GRPO-style group sampling, an adaptive curriculum tracks the Defender's weaknesses with an EMA matrix and escalates against them (Red Queen dynamics), and an LLM-as-Judge evaluator scores both sides after every episode. Attacks escalate through three social-engineering phases — DENY (fake clean bills of health), AUTHORITY (fabricated CISO directives), and GASLIGHT (retroactive contradiction of the defender's own actions) — over MITRE ATT&CK-tagged network simulations of up to 60 hosts. A built-in counterfactual endpoint replays each episode with zero injections to quantify the exact cost of cognitive warfare. 84 passing tests, OpenEnv REST compliant. Co-authored with Umyal Dixit for the Meta × PyTorch × Hugging Face OpenEnv Hackathon India 2026.