PaperlayerView exact revision on arXiv

Source-linked AI summary

Automation-Exploit: A Multi-Agent LLM Framework for Adaptive Offensive Security with Digital Twin-Based Risk-Mitigated Exploitation

Biagio Andreucci, Arcangelo Castiglione

arXiv:2604.22427v1cs.CR

TL;DR

Enterprise platforms avoid memory-corruption exploits, AEG systems lack semantic context, and LLM agents face safety-alignment and live-fire hazards. Automation-Exploit combines autonomous multi-protocol exfiltration with conditional Digital Twin testing and multi-agent controls. Across eight scenarios, including undocumented zero-day environments, it reports risk-mitigated compromises on actual targets while preventing live-fire crashes.

  • Problem

    Existing approaches separately limit safe memory-corruption testing, semantic understanding for binary exploitation, and autonomous LLM execution in black-box settings.

    Source: §3.6 · p. 7

  • Method

    Automation-Exploit autonomously exfiltrates executables and context, then conditionally tests destructive payloads in a synchronized Digital Twin before target execution.

    Source: §1 · p. 3

  • Results

    Across eight scenarios, including undocumented zero-day environments, the framework demonstrated autonomous reasoning and risk-mitigated compromise of actual targets while preventing live-fire crashes.

    Source: §1 · p. 3, §8 · p. 22

  • Takeaways & Limitations

    The evaluation supports risk-mitigated one-shot memory-corruption exploitation within the framework’s tested scenarios.

    Source: §8 · p. 22

    High architectural overhead yields high Time-to-Compromise, and evaluation in controlled air-gapped environments does not include active perimetric defenses.

    Source: §8.2 · p. 22

Abstract

from arXiv · show

The offensive security landscape is highly fragmented: enterprise platforms avoid memory-corruption vulnerabilities due to Denial of Service (DoS) risks, Automatic Exploit Generation (AEG) systems suffer from semantic blindness, and Large Language Model (LLM) agents face safety alignment filters and "Live Fire" execution hazards. We introduce Automation-Exploit, a fully autonomous Multi-Agent System (MAS) framework designed for adaptive offensive security in complex black-box scenarios. It bridges the abstraction gap between reconnaissance and exploitation by autonomously exfiltrating executables and contextual intelligence across multiple protocols, using this data to fuel both logical and binary attack chains. The framework introduces an adaptive safety architecture to mitigate DoS risks. While it natively resolves logical and web-based vulnerabilities, it employs a conditional isomorphic validation for high-risk memory-corruption flaws: if the target binary is successfully exfiltrated, it dynamically instantiates a cross-platform digital twin. By enforcing strict state synchronization, including libc alignment and runtime file descriptor hooking, potentially destructive payloads are iteratively debugged in an isolated replica. This enables a highly risk-mitigated "one-shot" execution on the physical target. Empirical evaluations across eight scenarios, including undocumented zero-day environments to rule out LLM data contamination, validate the framework's architectural resilience, demonstrating its ability to prevent "live fire" crashes and execute risk-mitigated compromises on actual targets.

1 Introduction

Scanners, enterprise platforms, AEG systems, and LLM agents each leave gaps between finding vulnerabilities and safely validating complex exploits. Automation-Exploit combines autonomous reconnaissance and exploitation with conditional digital-twin testing and multi-agent controls.

1 Introduction

  • The ecosystem lacks a bridge from web reconnaissance to binary exploitation that can extract target binaries, test exploits in replicas, and deliver them in a risk-mitigated execution.The gap spans enterprise safety limits, AEG semantic blindness, and LLM safety and live-fire hazards.Source: §1 · p. 3
  • Automation-Exploit exfiltrates executables and contextual intelligence across protocols to fuel logical and binary attack chains, then conditionally tests destructive payloads in a synchronized Digital Twin.The twin uses libc alignment and runtime File Descriptor Hooking before one-shot execution on the target.Source: §1 · p. 3

1.1 Contributions of the Paper

  • Its Adversarial Hand-off, Adaptive Pruning, and Two-Stage Adversarial Auditing address cloud safety alignment, fruitless attack paths, and generative hallucinations.The Navigator truncates unproductive vectors, while an independent reviewer scrutinizes forensic logs.Source: §1 · p. 3, §1.1 · p. 4

1.2 Paper Organization

  • The paper proceeds from background and state-of-the-art analysis to architecture, implementation, evaluation, ethical considerations, and future work.Source: §1.2 · p. 4

2 Background

The background situates Automation-Exploit across offensive security, LLM-based automation, multi-agent systems, and digital-twin technologies. It motivates active penetration testing, validation of probabilistic outputs, role-specialized agents, and isolated exploit testing.

2.1 Offensive Security Fundamentals

  • Penetration testing actively exploits flaws to validate concrete risks, whereas vulnerability assessment produces unverified lists; Automation-Exploit performs penetration testing autonomously.Source: §2.1 · p. 4
  • The framework maps operations to MITRE ATT&CK phases and uses CVE/CPE asset mapping and EPSS prioritization because CVSS may not reflect real-world exploitability.EPSS prioritizes attacks by actual likelihood rather than theoretical severity.Source: §2.1 · p. 4

2.2 Large Language Models in Security Automation

  • LLMs can produce syntactic and semantic hallucinations, so the framework uses an Adversarial Hand-off to separate semantic planning from code generation under cloud safety alignment constraints.Source: §2.2 · pp. 4–5

2.3 Autonomous Agents and Multi-Agent Systems

  • The MAS divides exploitation work among specialized Personas, bounding contextual visibility to address cognitive overload and representation drift.The framework includes roles such as Drafter and Reviewer.Source: §2.3 · p. 5

2.4 Digital Twin and Virtualization Technologies

  • A predictive Safety Layer isolates destructive exploits and synchronizes shared libraries and runtime file descriptors so the replica mirrors target behavior.Source: §2.4 · p. 5

3 State of the Art and Research Gap

Prior approaches divide semantic reconnaissance, binary exploit generation, and safe execution across different systems. The comparison positions Automation-Exploit as combining autonomous exfiltration, multi-agent controls, and synchronized digital-twin testing.

3.1 Deterministic Vulnerability Scanners and Enterprise Platforms

  • Enterprise platforms use benign payloads and deliberately stop at memory-corruption flaws because they lack isolated infrastructure to test exploit stability without DoS risk.Source: §3.1 · p. 5

3.2 Automatic Exploit Generation Systems

  • AEG engines mathematically explore memory paths and generate shellcode but cannot navigate web applications or autonomously exfiltrate binaries in black-box settings.They therefore require operators to supply isolated binaries.Source: §3.2 · p. 5

3.3 LLM-Based Offensive Agents

  • LLM agents may refuse exploit generation under cloud safety alignment and can expose targets to crashes and DoS by executing memory-corruption code live.Source: §3.3 · p. 6

3.4 Open-Source Frameworks and Tool-Augmented Agents

  • Tool-augmented open-source systems automate repetitive tasks and proof-of-concept exploits, but predominantly focus on web and logical vulnerabilities rather than synchronized memory-corruption testing.Source: §3.4 · p. 6

3.5 Critical Comparative Analysis

  • Automation-Exploit uses a local model to bootstrap an exploitation skeleton and shifts cloud-model work to code repair, addressing safety-filter refusals through semantic masking.Source: §3.5 · p. 6
  • Its Navigator retrospectively analyzes forensic logs and issues ABORT or JUMP verdicts to truncate fruitless attack vectors more dynamically than rigid pre-planned approaches.Source: §3.5 · p. 6
  • Unlike single-agent wrappers that pipe monolithic outputs into tools, Automation-Exploit segregates specialized agents to bound context and prevent representation drift.Source: §3.5 · p. 6
  • Automation-Exploit bridges web reconnaissance and binary exploitation by exfiltrating hidden assets and testing high-risk payloads in a Digital Twin before one-shot delivery.The twin supports isomorphic validation; platforms such as Pentera or NodeZero avoid these flaws because of DoS risks.Source: §3.5 · pp. 6–7

4 Proposed Framework: Architecture and Design

Automation-Exploit organizes autonomous offensive security around specialized agents, persistent cross-port context, adaptive task routing, and a conditional digital-twin safety layer. An independent reviewer audits reported compromises.

4.1 Multi-Agent Cognitive Architecture

  • Action Executability Rate (AER) remains between 85% and 100% across complex scenarios as specialized agents separate roles under bounded prompts.The framework assigns agents only the inputs required for their tasks, mitigating context-window and representation-drift problems.Source: §4 · p. 8, §4.1 · p. 8

4.2 Unified Knowledge Base for Context Persistence

  • Persistent structured memory aggregates target data and lets agents reuse intelligence or binaries from one port to attack services on other ports.This can include using an extracted binary to instantiate a Digital Twin for a vulnerability found on another port.Source: §4.2 · pp. 8–9

4.3 Decision Engine and Adaptive Pruning

  • The Decision Engine queues tasks with service, vulnerability, environment-artifact, and priority fields; after iteration limits, Navigator can continue, skip, or abort a branch.Priority combines normalized EPSS, CVSSbase, and artifact-context scores with weights 0.6, 0.2, and 0.2.Source: §4.3 · p. 10

4.4 Safety Layer: Digital Twin-Based Protection

  • After successful binary exfiltration, the safety layer creates a cross-platform replica and gates destructive-payload debugging on behavioral symmetry with the physical target.Exact libc alignment and runtime file-descriptor hooking support translation to the target; twin crashes trigger restoration and forensic feedback for refinement.Source: §4.4 · p. 10

4.5 Two-Stage Validation Protocol

  • An independent Reviewer checks perceived successes against forensic logs, outputs, and errors, improving the reliability of reported vulnerabilities.The Reviewer audits without generating code, mitigating generative-model self-delusion.Source: §4.5 · p. 11

5 Implementation

Section 5 describes implementation choices for protocol identification, asset extraction, vulnerability tasking, LLM orchestration, twin-based testing, and execution validation. These address deterministic discovery, context management, isomorphic fidelity, and runtime reliability.

5.1 Reconnaissance and Asset Scavenging

  • Active HTTP HEAD interrogation resolves ambiguous services after global port discovery, and extracted artifacts are deduplicated before unique intelligence enters persistent state.Agents extract binaries and configurations into an isolated drop-zone.Source: §5.1 · p. 11

5.2 Vulnerability Intelligence and Task Generation

  • The vulnerability module maps enumeration data to CPE v2.3 and enriches it with NVD, CAPEC, and MITRE ATT&CK context, then unifies CVE and AI-inferred tasks for ROI-based prioritization.The heuristic engine scores sensitive endpoints and exposed banners to synthesize attack vectors.Source: §5.2 · p. 11

5.3 Hybrid LLM Orchestration

  • Local Mistral drafts exploit skeletons for Gemini Pro to refine, while checkpoints, context retrieval after stagnation, and model cascading manage context and API continuity.The local model’s isolated reasoning is not evaluated; its purpose is to provide a rough skeleton for cloud-model refinement.Source: §5.3 · p. 12

5.4 Digital Twin and Forensic Pipeline

  • When a target binary is exfiltrated, the system can provision a Linux, Windows Native, or WINE twin and test its behavioral fidelity before exploitation.The design uses isomorphic pre-validation to stabilize potentially destructive payloads before one-shot execution on the physical target.Source: §5.4 · pp. 12–13
  • A decoupled seven-stage forensic pipeline combines static reverse engineering with dynamic fuzzing for offsets, ASLR/PIE detection, and ROP gadgets, then sanitizes telemetry into a vulnerability blueprint.The pipeline is intended to extract ground truth without polluting the replica.Source: §5.4 · p. 13
  • Runtime file-descriptor synchronization mirrors the target’s network topology, while crash callbacks return register-state telemetry and provision a fresh twin for the next iteration.The Autopsy callback extracts core dumps or Windows minidumps to support deterministic payload refinement.Source: §5.4 · p. 13, Figure 3 · p. 14

5.5 Execution Sandbox and Validation

  • The execution engine uses runtime language detection, output sanitization, an isolated sandbox, and health checks; a two-stage validator checks output signals before independent LLM review.The reviewer compares code with forensic logs and Autopsy telemetry to reject logical hallucinations.Source: §5.5 · p. 14

6 Experimental Evaluation

The evaluation tests the framework across eight scenarios, with experiments run on a consumer-grade mobile workstation in an air-gapped virtual network. It defines four KPIs for efficiency, time, hallucinations, and code stability.

6 Experimental Evaluation

  • Eight scenarios of increasing complexity evaluate the framework, with scope limited to initial access and execution against a single target IP rather than network-wide discovery or lateral movement.The scenarios focus on complex individual nodes to measure deep reasoning on a one-to-one engagement basis.Source: §6 · p. 14, §6.1 · p. 15

6.1.1 Testing Environment

  • Experiments use a consumer-grade GPU workstation for local Mistral 7B inference and isolate targets in an air-gapped VirtualBox Host-Only network.The hardware choice is intended to demonstrate local inference feasibility on standard professional-grade laptops without specialized server infrastructure.Source: §6.1.1 · p. 15
  • The four KPIs are GER for iteration efficiency, TTC for reconnaissance-to-validation time, pre-review FPR for hallucinations, and AER for generated-code stability.GER uses a maximum of 12 iterations for standard web and logical CVEs and 24 when the Digital Twin Safety Layer is activated.Source: §6.1.1 · p. 15

6.2 Case Study Overview

The evaluation covers eight increasingly complex scenarios, including custom zero-day environments, and examines efficiency, execution reliability, operational time, and risk-mitigated exploitation.

6.2 Case Study Overview

  • The eight scenarios increased in complexity, with custom zero-day environments G and H testing procedural reasoning and Digital Twin telemetry.Initial benchmarks assessed logical pivoting and adversarial auditing; later tests introduced environmental frictions to trigger Self-Healing and meta-reasoning.Source: §6.2 · p. 15, Table 3 · p. 16

6.3.1 Operational Efficiency (GER vs. TTC)

  • GER exceeded 96% in five scenarios, while TTC ranged from 91.4 minutes in D to 171.0 minutes in A.Scenarios F and G required exhaustive exploration of constrained binary surfaces; TTC did not vary linearly with efficiency.Source: §6.3.1 · p. 16, Figure 4 · p. 16

6.3.2 Cognitive Dynamics and Reliability (AER vs. FPR)

  • AER was 85%–100% in A, B, C, G, and H; Stage 2 confirmed none of Stage 1’s false positives as final compromises across eight scenarios.AER fell to 60%–64% in D, E, and F, where deterministic Self-Healing resolved environmental frictions.Source: §6.3.2 · p. 17, Figure 5 · p. 17

6.3.3 Temporal Distribution Analysis and Operational Bottlenecks

  • Phase 1 consumed 77.2% (793.3 minutes) of total time, Phase 2 19.9% (204.6 minutes), and Digital Twin synchronization 2.9% (29.5 minutes).The Phase 1 bottleneck was sequential extraction and contextualization across multiple ports; twin instantiation was conditional.Source: §6.3.3 · p. 17, Figure 6 · p. 18

6.3.4 Empirical Validation of Risk-Mitigated Exploitation

  • 9 critical DoS conditions in Scenario G and 5 in H were absorbed by the replica; Scenario F recorded zero critical failures.The forensic engine also used the Digital Twin to extract Ground Truth offsets in Scenario F.Source: §6.3.4 · pp. 18–19, Table 4 · p. 18

6.4 Comparative Analysis with State-of-the-Art

The comparison contrasts Automation-Exploit with enterprise CTEM platforms, AEG systems, and autonomous LLM agents, emphasizing their differing coverage and execution risks.

6.4 Comparative Analysis with State-of-the-Art

  • Unlike CTEM platforms that avoid memory-corruption flaws to prevent DoS, Automation-Exploit uses a Digital Twin to validate one-shot execution in Scenarios F, G, and H.The comparison describes the replica as absorbing triage crashes before physical-target execution.Source: §6.4 · p. 19
  • Unlike AEG systems that require human-provided executables and cannot handle logical web flaws, Automation-Exploit addresses web scenarios A–E and extracts binaries for F–H.The passage attributes AEG’s limitation to semantic blindness and confinement to memory exploration.Source: §6.4 · p. 19
  • The comparison characterizes autonomous LLM agents as facing safety-alignment constraints and hallucination risks, with “Live Fire” memory-corruption exploits posing DoS hazards [29].The authors argue that traditional success-rate benchmarks overlook this operational hazard.Source: §6.4 · p. 19
  • A Scenario G ROP payload segfaulted at 0xdeadbeef on the physical target, illustrating the immediate DoS hazard of unvalidated “Live Fire” execution.The isolated container absorbed the crash telemetry, which informed a Self-Healing loop that refined the exploit chain.Source: §6.4 · p. 19

6.5 Experimental KPI Summary

Table 5 consolidates the experimental KPIs across the eight evaluation scenarios.

6.5 Experimental KPI Summary

  • Table 5 is presented as a consolidated overview of the measured indicators, rather than a passage reporting their scenario-level values.The supplied caption lists KPI names and scope but does not state cell values.Source: §6.5 · p. 19, Table 5 · p. 20
  • The KPI summary covers GER, TTC, FPR for generative hallucinations, and AER across all eight scenarios.GER is Global Efficiency Ratio, TTC is Time-to-Compromise, and AER is Action Executability Rate.Source: §6.5 · p. 19, Table 5 · p. 20
  • The summary identifies four KPI dimensions: efficiency, time-to-compromise, false positives, and action executability.The caption defines FPR as False Positive Rate for generative hallucinations.Source: Table 5 · p. 20

6.6 Discussion of Results and Bias Analysis

The discussion tests whether results reflect procedural reasoning rather than memorized public solutions, then examines evaluation limits and resilience to model changes.

6.6 Discussion of Results and Bias Analysis

  • Scenarios G/H support procedural reasoning without public CVEs; C used pretrained OSINT, F required twin-derived offsets, and D/E tested live recovery.The custom zero-days required exfiltration, Digital Twin instantiation, heap reverse-engineering, and dynamic offsets for Ret2Libc and ROP chains.Source: §6.6 · p. 20

6.6.1 Evaluating Operational Safety vs. Traditional Benchmarking

  • Evaluation prioritizes depth over breadth: sequential, I/O-bound reconnaissance and exfiltration consume over 77% of total time, while baseline comparisons face architectural limits.Commercial CTEM testing was precluded by proprietary platforms; AEG systems lack web navigation for mixed-protocol scenarios, and comparison with tool-augmented LLM wrappers such as PentestGPT is methodologically unsound.Source: §6.6.1 · pp. 20–21

6.6.2 Longitudinal Resilience and Reproducibility Dynamics

  • Across C, F, and G, Day 0 and two independent runs after 30 days showed stable convergence despite generative non-determinism; updated models also triggered safety refusals.The targeted subset was chosen because exhaustive runs were computationally prohibitive given high TTC and API budgets.Source: §6.6.2 · p. 21
  • The system extracted offsets from censored responses and reconstructed ROP chains locally, while a Base64-obfuscated prompt matched the baseline payload’s success rate in Scenario H.The Adversarial Hand-off and local model loop are described as persistent infrastructure, with external adversarial templates as interchangeable tactics.Source: §6.6.2 · p. 21

7 Ethical Considerations and Dual-Use Implications

The paper frames autonomous exploitation as dual-use, confines its evaluations to authorized air-gapped environments, and identifies noisy exfiltration as a practical constraint.

7 Ethical Considerations and Dual-Use Implications

  • The framework could be repurposed by malicious actors, so evaluations were restricted to explicitly authorized, air-gapped virtual environments.The Adversarial Hand-off is presented as a diagnostic method for exposing fragile generative guardrails, not as a malicious blueprint.Source: §7 · p. 21
  • Aggressive autonomous exfiltration is noisy, and the framework lacks stealth modules against WAF, IPS, and active EDR monitoring.The paper states that deployment against hardened real-world infrastructure would result in immediate detection and neutralization.Source: §7 · p. 22
  • The authors position transparency about capabilities and limitations as a way to help defenders develop countermeasures before evasive LLM agents are operationalized.The proposed Digital Twin Safety Layer is named as one such countermeasure.Source: §7 · p. 22

8 Conclusions and Future Work

Automation-Exploit combines autonomous reconnaissance, exploitation, and a conditional Digital Twin safety layer; the authors report eight-scenario risk-mitigated compromises and identify substantial scope and operational limits.

8 Conclusions and Future Work

  • Across eight scenarios, including undocumented zero-days, Automation-Exploit reports autonomous, risk-mitigated compromises while preventing denial of service.The conclusion describes the framework as bridging semantic web reconnaissance and precise binary exploitation through autonomous exfiltration, adversarial hand-off, adaptive pruning, and conditional Digital Twin validation.Source: §8 · p. 22

8.1 Summary of Contributions

  • Boundary-aware exfiltration retrieves executables and contextual intelligence, which the system correlates into cross-protocol attack chains against adjacent services.The framework also manages Docker hypervisors, isolated container lifecycles, and external deterministic tools without human setup or binary-execution assistance.Source: §8.1 · p. 22
  • For memory-corruption exploitation, synchronized Digital Twins use libc alignment and runtime file-descriptor hooking to debug destructive payloads in isolation before one-shot target execution.The authors say this substantially mitigates unintended denial-of-service risk on actual targets.Source: §8.1 · p. 22
  • Adversarial hand-off decouples reasoning from code generation; adaptive pruning reduces computational budgets, and two-stage auditing cross-checks payloads against forensic telemetry.The auditing protocol is intended to reduce false positives from generative hallucinations.Source: §8.1 · p. 22

8.2 Limitations

  • High TTC limits the framework to targeted, low-and-slow engagements; controlled air-gapped evaluation leaves it defenseless against WAFs and IPSs.Three runs per scenario were constrained by costly, multi-hour trials, although low inter-run variance across eight scenarios is reported.Source: §8.2 · pp. 22–23
  • The framework is limited to single-node initial access, lacks pivoting and lateral movement, and retains risks from shared auditor hallucinations and procedural stubbornness.The authors also report over-engineering bias and difficulty distinguishing correctable errors from hard defensive blocks.Source: §8.2 · p. 23

8.3 Future Research Directions

  • Future work proposes parallelizing I/O-bound reconnaissance and adding checkpointed stateful workflows for continuity across extended engagements.The stated goals are to reduce TTC and support continuity resembling advanced persistent threat operations.Source: §8.3 · p. 23
  • Planned extensions include QEMU full-system emulation, episodic memory with Reflexion, and monitored-range adversarial emulation to stress-test defensive systems.The proposed payload generation is explicitly confined to monitored cyber ranges rather than stealthy real-world exploitation.Source: §8.3 · p. 23

Availability of Data and Materials

Supporting environments and forensic materials were submitted for peer review, while the supplementary repository remains temporarily restricted.

Availability of Data and Materials

Related papers

Loading 2604.22427v1…