To address the significant gap between single-machine evaluations and real-world performance of traditional cybersecurity large models, the research team built CyberArena, a symmetric attack-defense confrontation arena, and organized 12 cutting-edge models to conduct 466 real-time bidirectional attack-defense matches. The evaluation simultaneously considered three types of indicators: attack capture-the-flag, vulnerability defense, and business availability. Results show that under dynamic confrontation, model capabilities are clearly stratified, with GPT-5.6 Sol and Claude Opus 5 demonstrating a breakthrough advantage. Capability gaps that are difficult to reveal in static question answering become prominent in dynamic games—nearly half, or even more than sixty percent, of effective attacks in single-machine environments fail in confrontation. The research team used a latent variable capability modeling framework to complete combat power rankings, finding that response speed and adaptability on the defense side are the core factors that set top models apart. They also summarized typical failures of various models during attack and defense, such as false remediation and incomplete patching. This kind of symmetric confrontation evaluation is not prone to score saturation like static benchmark tests and can more truly reflect the marginal advantages of models in attack-defense tug-of-war, providing a new evaluation pathway for cybersecurity AI agents to move from solving questions to real-world combat.