PaperlayerView exact revision on arXiv

Source-linked AI summary

VulnBot: Autonomous Penetration Testing for A Multi-Agent Collaborative Framework

He Kong, Die Hu, Jingguo Ge, Liangxiong Li, Tong Li, Bingzhen Wu

arXiv:2501.13411v1cs.SE

TL;DR

Penetration testing remains labor-intensive and existing LLM-assisted approaches face contextual and efficiency limitations. VulnBot uses specialized multi-agent phases coordinated by a Penetration Task Graph and related communication mechanisms. It outperformed baseline models and, with RAG, completed end-to-end penetration tasks autonomously on real-world machines.

  • Problem

    Traditional penetration testing is labor-intensive and time-consuming, while existing LLM-assisted or automated approaches suffer from inefficiency, context loss, and information overload.

  • Method

    VulnBot is an autonomous multi-agent framework that decomposes testing into reconnaissance, scanning, and exploitation, coordinating phases with a PTG, specialized roles, and inter-agent communication.

  • Results

    VulnBot outperformed baseline models, achieving a 30.3% overall completion rate on AUTOPENBENCH, while RAG enabled autonomous end-to-end penetration tasks on real-world machines.

  • Takeaways & Limitations

    The results demonstrate VulnBot’s potential for more efficient, scalable, and autonomous penetration testing workflows.

  • Takeaways & Limitations

    VulnBot cannot process non-textual information and still faces difficulties achieving full autonomy and success across all stages of real-world penetration tests.

Abstract

from arXiv · show

Penetration testing is a vital practice for identifying and mitigating vulnerabilities in cybersecurity systems, but its manual execution is labor-intensive and time-consuming. Existing large language model (LLM)-assisted or automated penetration testing approaches often suffer from inefficiencies, such as a lack of contextual understanding and excessive, unstructured data generation. This paper presents VulnBot, an automated penetration testing framework that leverages LLMs to simulate the collaborative workflow of human penetration testing teams through a multi-agent system. To address the inefficiencies and reliance on manual intervention in traditional penetration testing methods, VulnBot decomposes complex tasks into three specialized phases: reconnaissance, scanning, and exploitation. These phases are guided by a penetration task graph (PTG) to ensure logical task execution. Key design features include role specialization, penetration path planning, inter-agent communication, and generative penetration behavior. Experimental results demonstrate that VulnBot outperforms baseline models such as GPT-4 and Llama3 in automated penetration testing tasks, particularly showcasing its potential in fully autonomous testing on real-world machines.

1 Introduction

VulnBot addresses the labor-intensive nature and inefficiencies of automated penetration testing with an autonomous, multi-agent framework organized around specialized phases and task dependencies. It outperformed baseline models on benchmarked tasks and achieved end-to-end testing on real-world machines when integrated with RAG.

  • Motivation: Traditional penetration testing is labor-intensive and time-consuming, while LLM-assisted and automated approaches face context loss, information overload, and manual intervention.These limitations motivate more efficient and scalable automation.
  • Framework: VulnBot emulates collaborative human penetration-testing teams through specialized reconnaissance, scanning, and exploitation roles.The framework uses a phased design to focus agents on specific tasks and reduce information loss.
  • Coordination: VulnBot coordinates agents through penetration-path planning, inter-agent communication, and generative penetration behavior.The Summarizer transfers key outcomes between phases, including reconnaissance findings needed for scanning.
  • Results: 30.3% overall completion rate was achieved by VulnBot-Llama3.1-405B on AUTOPENBENCH, compared with 9.09% for Llama3.1-405B and 21.21% for GPT-4o.VulnBot also achieved the best performance on six real-world machines, and RAG enabled complete end-to-end penetration there.
  • Task Planning: The Penetration Task Graph models task dependencies as a directed acyclic graph, enforcing logical execution order and supporting task-progress tracking.A Check and Reflection Mechanism adapts plans using execution feedback for error handling.

2 Background & Motivation

Penetration testing evaluates systems by simulating attacks, but traditional and existing automated approaches remain costly, labor-intensive, context-limited, or dependent on human intervention. An exploratory study identifies context loss, command-generation errors, weak error handling, and poor cross-phase reasoning as central challenges for autonomous testing.

  • Background: Penetration testing simulates malicious attacks to identify and remediate vulnerabilities in systems, networks, or applications.The process typically includes reconnaissance, scanning, exploitation, maintaining access, and reporting.
  • Motivation: Traditional penetration testing is time-intensive and costly, while LLM-assisted systems may require frequent user intervention or generate unstructured, non-actionable output.The conventional automated approach can suffer context loss and command failures.
  • Task Definition: Autonomous penetration testing is defined here as testing conducted entirely without human intervention, excluding tasks where testers provide guidance.The study focuses on fully autonomous tasks and uses open-source models to reduce expenses.
  • Exploratory Study: The exploratory study examines open-source LLM performance, failure causes, and phase-specific behavior using AUTOPENBENCH and AI-Pentest-Benchmark evaluations.AUTOPENBENCH contains 33 simulated real-world tasks, while AI-Pentest-Benchmark contains 13 real machines from Vulnhub.
  • Challenges: Session-context loss is a primary failure cause across reconnaissance and exploitation, while models also struggle with command generation, error handling, and integrating findings across phases.These limitations can cause forgotten discoveries, inaccurate commands, manual intervention, and fragmented analyses.

3 Design

VulnBot uses a modular multi-agent architecture to emulate collaborative penetration testing teams. Its design combines role specialization, three sequential testing phases, task-graph planning, memory and communication modules, and generated execution behavior.

  • Overview: VulnBot uses Planner, Memory Retriever, Generator, Executor, and Summarizer modules to automate reconnaissance, scanning, and exploitation.The architecture is designed to adapt to unforeseen challenges across diverse testing scenarios.
  • Specialization of Roles: Role specialization decomposes penetration testing into subtasks so agents can focus on objectives requiring distinct skills and tools.The approach reflects the interdependent phases of penetration testing.
  • Testing Phases: VulnBot restructures the process into reconnaissance, scanning, and exploitation to reduce information loss caused by long multi-phase execution.Reconnaissance gathers open ports and services; scanning identifies vulnerabilities and misconfigurations; exploitation seeks access and privilege escalation.
  • Penetration Path Planning: The Penetration Testing Task Graph organizes dependent tasks into a logical execution sequence tailored to the target and user requirements.The Planner creates structured task lists with identifiers, dependencies, instructions, and action types, then updates plans through feedback.
  • Communication and Execution: The Task Session generates instruction-specific details for execution, while retrieval-augmented generation is used to mitigate hallucination.The Summarizer transmits key outcomes between phases to preserve critical information.

Reconnaissance

VulnBot structures penetration testing as coordinated, dependency-aware tasks across specialized execution modes and communication roles. Its PTG and Summarizer support ordered execution, plan revision, and transfer of relevant state between phases.

  • Task-driven mechanism: PTG dependencies enforce logical, conflict-free task sequencing while tracking task progress and execution results.Tasks are organized around preceding-task requirements so later actions follow the intended penetration path.
  • Task-driven mechanism: The PTG represents penetration testing as a directed acyclic graph whose nodes are tasks and whose edges encode dependencies.Each task can include an instruction, action type, dependencies, execution result, and completion or success status.
  • Penetration path planning: The Planner builds a JSON-compliant PTG from user requirements and target characteristics, then updates it using execution feedback.The Check and Reflection Mechanism supports iterative adaptation, while the Merge Plan Algorithm preserves completed tasks and dependencies when integrating new tasks.
  • Inter-Agent Communication: The Summarizer transfers concise reconnaissance, scanning, and shell-state information between roles to preserve context and reduce redundant work.Examples include open ports, service banners, operating-system fingerprints, software versions, discovered vulnerabilities, and current shell access.
  • Execution modes: VulnBot supports automatic, manual, and semi-automatic operation, with the evaluation focused on fully autonomous execution.In semi-automatic mode, shell commands run automatically while tasks marked manual require user execution and returned results.
  • Generative penetration behavior: The Generator converts planned tasks into tool-specific commands, and the Executor runs them through an interactive shell before returning results for analysis.Together, these modules connect abstract task plans to adaptive command execution.

4 Implementation

VulnBot was implemented as a Python prototype and evaluated in a controlled Kali Linux environment with several large language models. The experiments used configured context, temperature, and task-step limits, with PentestGPT adapted as a baseline.

  • Implementation: The VulnBot prototype comprises approximately 3,000 lines of Python code and publicly accessible source code.The implementation is complemented by designed prompts and hosted in a public GitHub repository.
  • Experimental environment: Experiments used a 2023 Kali Linux attacking platform selected for its penetration-testing tool suite.The controlled environment served as the attacking machine for target-system evaluation.
  • Experimental configuration: The evaluation used Llama3.3-70B, Llama3.1-405B, and DeepSeek-v3 with context lengths of 128k, 128k, and 64k tokens, respectively.LLM temperature was set to 0.5, and AUTOPENBENCH execution was limited to 15 steps, with a maximum of five steps per phase.
  • Experimental configuration: Retrieval Augmented Generation experiments used a Memory Retriever with a vector database to retrieve relevant historical tasks and penetration knowledge.The module was used to mitigate hallucination through embedding-based retrieval of prior experience.
  • Baseline: PentestGPT was modified as a benchmark while retaining its original prompts, with generated commands executed and results fed back for analysis.This setup simulated a manual copy-paste process without additional interpretation.

5 Evaluation

VulnBot was evaluated on benchmark, ablation, real-world, and retrieval-augmented penetration-testing tasks. Across these settings, its task decomposition and multi-agent components improved completion and reduced early-stage failures, while exploitation remained challenging.

  • Evaluation Design: Evaluation covered baseline comparisons, component ablations, six real-world machines, and Memory Retriever integration across four research questions.AUTOPENBENCH included Access Control, Web Security, Network Security, Cryptography, and Real-world categories.
  • Baseline Comparison: 69.05% single-experiment and 49.90% five-experiment subtask completion were achieved by VulnBot-Llama3.1-405B, versus 49.05% and 24.76% for its baseline.The comparison was reported for Llama3.1-405B in Table 3.
  • Failure Analysis: VulnBot-Llama3.1-405B had 9 reconnaissance failures and 32 scanning failures, with 19 tasks reaching Finish versus 7 for the baseline.The reported advantage was concentrated in the early stages, while exploitation still required refinement.
  • Ablation Study: Removing role specialization reduced subtask success from 55 to 32, removing PTG reduced it to 37, and removing the Summarizer reduced it to 27.The ablation study evaluated AUTOPENBENCH Real-world tasks with Llama3.1-405B in a 128k-token context.
  • Real-World Evaluation: On six real-world machines, VulnBot-Llama3.1-405B achieved the highest completion rates on Victim1, Library2, and WestWild, while VulnBot-DeepSeek-v3 reached 0.83 on Victim1 and 0.71 on WestWild.Each reported machine rate represented the best result across five experimental runs.
  • Retrieval-Augmented Evaluation: Integrating the Memory Retriever significantly improved performance on specific machines, particularly Victim1 and WestWild, and enabled end-to-end penetration of WestWild.The integration used retrieval-augmented generation to improve contextual understanding and task-specific optimization.

6 Discussion

The discussion presents VulnBot as promising for vulnerability detection and exploitation while identifying unresolved challenges. The principal limitation is incomplete automation when testing requires non-textual information or complex real-world end-to-end execution.

  • Discussion: VulnBot shows potential for efficient vulnerability detection and exploitation, but further challenges and future research remain.The discussion frames this as a supported potential rather than a completed capability across all settings.
  • Limitations: VulnBot cannot process images or graphical interfaces from penetration-testing tools and currently relies on manual descriptions of these elements.The paper identifies image recognition and processing as a future direction for improving automation.
  • Limitations: Although VulnBot completed one 2024-CVE task without prior vulnerability knowledge, end-to-end penetration testing on real-world machines remains a significant challenge.The result was obtained despite the underlying models’ December 2023 knowledge cutoff.

7 Related Work

Prior work applies LLMs to vulnerability management, penetration-testing planning, vulnerability hunting, attack simulation, and broader cybersecurity tasks. The paper situates VulnBot among these approaches while emphasizing persistent limitations in autonomy, adaptability, and reliability.

  • Related Approaches: PentestGPT addresses context loss through interconnected reasoning, generation, and parsing modules, while other systems target specialized fuzzing or RESTful API testing.Atropos focuses on snapshot-based feedback-driven fuzzing for PHP applications, and NAUTILUS targets RESTful APIs.
  • Broader Cybersecurity Applications: Related cybersecurity applications include domain-knowledge summarization for bug reports, iterative code self-refinement, optimization-bug detection, and vulnerability exploitation.These examples extend LLM use beyond penetration testing.
  • LLM-Assisted Penetration Testing: Prior systems use LLMs for reconnaissance, post-exploitation, attack simulation, ethical research assistance, task planning, and vulnerability hunting.Examples include GPT-4-based workflows, AUTOATTACKER, BreachSeek, CIPHER, and feedback-loop systems executing actions on virtual machines.
  • Open Challenges: Existing approaches remain limited by dependence on detailed vulnerability descriptions, variable performance across tasks and environments, human intervention, weak long-term planning, and inconsistent autonomy.The paper notes that assisted and multi-agent systems can improve success rates, but fully autonomous agents still face reliability challenges.

8 Conclusion

VulnBot automates penetration testing through specialized phases and a Penetration Task Graph, addressing manual dependencies and workflow inefficiencies. Experiments report stronger performance than GPT-4 and Llama3, with RAG supporting autonomous end-to-end tasks.

  • 8 Conclusion: VulnBot decomposes penetration testing into reconnaissance, scanning, and exploitation, using a PTG to maintain logical task execution.The framework is designed to emulate collaborative human penetration-testing workflows while reducing manual dependencies.
  • 8 Conclusion: The framework uses LLMs and multi-agent systems to automate penetration-testing workflows through specialized roles and phased task execution.
  • 8 Conclusion: VulnBot outperforms baseline models such as GPT-4 and Llama3 in automated penetration-testing tasks.
  • 8 Conclusion: RAG enables VulnBot to execute end-to-end penetration tasks autonomously without human intervention.

A Prompt Example

The appendix describes prompt templates that initialize phase-level planning and task-level behavior for specialized penetration-testing assistants. These prompts specify targets, goals, tools, prior-phase context, task decomposition, and result verification.

  • A Prompt Example: The appendix provides examples of Plan Session and Task Session prompts for guiding penetration testers through cybersecurity training stages.
  • A.1 Plan Session Initial Prompt: Plan Session Initialization establishes a structured session for a specific cybersecurity-training phase.
  • A.1 Plan Session Initial Prompt: The Plan Session template assigns a named assistant to reconnaissance, vulnerability scanning, or exploitation while requiring relevant prior-phase context.
  • A.1 Plan Session Initial Prompt: The template defines the assistant name as the specific assistant type, such as a Reconnaissance Assistant or Exploitation Assistant.
  • A.1 Plan Session Initial Prompt: The plan prompt includes an overall target, a current-phase goal, optional reference tools, and context from previous phases.Examples include testing a target IP, identifying open ports, using Nmap or Metasploit, and incorporating prior results.
  • A.1 Plan Session Initial Prompt: Assistant name, goal, and tools are fixed attributes, whereas context is derived from the summarizer’s output.
  • A.2 Task Session Initial Prompt: Task Session Initialization defines how an assistant manages individual cybersecurity-training tasks and evaluates their results.
  • A.2 Task Session Initial Prompt: Task sessions accept new tasks or task results: assistants break new tasks into actionable steps and verify success for returned results.For a task result, the assistant replies “yes” after confirming understanding.
Loading 2501.13411v1…