PaperlayerView exact revision on arXiv

Source-linked AI summary

Autonomous Active Directory Exploitation via Multi-Model Harness Orchestration: A Benchmark Study with NeuroSploit on GOAD

Joas Antonio dos Santos Barbosa

arXiv:2610.04243v1cs.CR

TL;DR

AD compromise is high-impact and requires maintaining state across sequential techniques, while standalone LLM approaches lack structured orchestration and validation. This paper evaluates NeuroSploit’s specialized agents and attack chains on GOAD. The harness reports broader technique coverage and higher precision than direct model invocation.

  • Problem

    AD compromise is high-impact and requires sequential techniques whose outputs become inputs to later steps, demanding sustained state management.

    Source: §I · p. 1

  • Method

    NeuroSploit deploys specialized AD agents and multi-stage chain agents that require proven tool receipts at each attack-path stage.

    Source: §III · p. 3, B. Multi-Stage Chain Agents · p. 4

  • Results

    96–100% coverage of 14 attack-technique categories versus 21–54% for direct invocation, with precision of 90–97% versus 53–72%.

    Source: §XVI · p. 19

  • Takeaways & Limitations

    For techniques stopped after capability proof, coverage measures reachability rather than completed exploitation.

    Source: §XV · p. 19

    GOAD is deliberately vulnerable; production environments have hardening, EDR, segmentation, and incident-response capabilities absent from the lab.

    Source: §XV · p. 19

Abstract

from arXiv · show

Active Directory (AD) remains the predominant identity and access management infrastructure in enterprise environments, and its compromise represents the highest-impact outcome in internal penetration tests. Recent work has shown that large language models (LLMs) can autonomously conduct assumed-breach penetration testing against AD, but these studies employ standalone agents lacking structured guardrails, deterministic validation, and multi-stage chain orchestration. We present a benchmark evaluation of NeuroSploit v4.2.0, an open-source Rust-based autonomous pentest harness, against the Game of Active Directory (GOAD), a deliberately vulnerable multi-forest AD lab maintained by Orange Cyberdefense comprising five virtual machines, two forests, and three domains. The harness orchestrates 22 AD-specific agents and 7 multi-stage attack-chain playbooks covering the full AD kill chain: enumeration, Kerberoasting, AS-REP roasting, NTLM relay and coercion, Kerberos delegation abuse, AD CS exploitation (ESC1-ESC8), MSSQL linked-server pivoting, DCSync, cross-forest trust abuse, and persistence detection. We benchmark nine frontier LLMs (Claude Opus 4.6/4.7/4.8, GPT-6 Astra, GPT-5.6 Sol, Grok 4.6, Qwen 3.8, GLM 5.3, Kimi k3) within the harness, comparing against direct invocation across 14 technique categories and 7 chains. The harness achieves 96-100% technique coverage with 90-97% precision, while direct invocation covers only 21-54% and produces 3.2x more false positives. Time to full three-domain compromise with Opus 4.8 was 134 minutes with guardrail activations preventing lockout-triggering sprays, unauthorized DCSync dumps, and out-of-scope reconnaissance. Results demonstrate that structured harness orchestration with domain-specialized agents, POMDP belief tracking, and cross-model voting substantially outperforms unstructured LLM usage for AD penetration testing.

I. INTRODUCTION

AD testing requires coordinated, stateful technique chains, while standalone LLM agents can lack reliable selection, state management, and validation. The paper evaluates NeuroSploit’s specialized harness and agents against the GOAD testbed.

I. INTRODUCTION

  • AD compromise matters because it is high-impact and demands sequential techniques, while standalone agents can conflate planning, execution, and validation.The paper evaluates NeuroSploit v4.2.0 against GOAD, including a harness-versus-direct-model comparison.Source: §I · pp. 1–2

A. LLM-Driven Autonomous Penetration Testing

  • Prior work demonstrated autonomous LLM-driven AD testing with COCHISE [1], but it lacked deterministic validators, cross-model voting, and structured guardrails.Other work explored multi-agent pentesting and benchmarking, including PentestGPT and agent teams [7].Source: A. LLM-Driven Autonomous Penetration… · p. 2

B. Active Directory Attack Taxonomy

  • AD compromise typically chains 3–7 techniques, with each technique’s output supplying an input to the next.The attack surface includes credential attacks, delegation and ACL abuse, AD CS, relays, DCSync, and cross-forest trust exploitation.Source: B. Active Directory Attack Taxonomy · pp. 2–3

C. GOAD: Game of Active Directory

  • GOAD is a deliberately vulnerable lab of five virtual machines across two forests and three domains, with bidirectional trusts.Its planted misconfigurations include vulnerable AD CS templates, dangerous ACLs, and partially disabled SID filtering.Source: C. GOAD: Game of Active Directory · p. 3, Figure 1 · p. 3

III. NEUROSPLOIT HARNESS ARCHITECTURE

  • NeuroSploit v4.2.0 uses 473 markdown agents overall and activates 22 AD agents plus seven multi-stage chain agents for AD engagements.Its four-layer architecture assigns distinct assurance roles to execution, orchestration, validation, and reporting.Source: §III · p. 3, Figure 2 · p. 3

A. AD Agent Architecture

  • Each AD agent specifies methodology, decision points, tool commands, safety constraints, reporting format, and links to prerequisite findings.The agent library spans reconnaissance, credential attacks, relay and coercion, privilege escalation, lateral movement, and domain compromise.Source: A. AD Agent Architecture · pp. 3–4

B. Multi-Stage Chain Agents

NeuroSploit’s chain agents advance through multi-hop attack paths only when tool receipts prove each stage. The accompanying belief engine, guardrails, lab setup, and configuration constrain how those paths proceed.

B. Multi-Stage Chain Agents

  • Seven AD chain agents orchestrate multi-hop attack paths, requiring proven tool receipts at each hop and returning a composite finding with per-stage evidence.The chains cover Kerberoasting-to-Domain-Admin, coercion-to-certificate abuse, cross-trust MSSQL pivoting, and other paths.Source: B. Multi-Stage Chain Agents · p. 4

C. POMDP Belief Engine

  • The belief engine withholds a finding while its probability distribution is diffuse, then sharpens belief through Bayesian updates as tool receipts accumulate.For cracked Kerberos tickets, the chain requires follow-up authentication proof before advancing.Source: C. POMDP Belief Engine · p. 4

D. Guardrail Architecture

  • Guardrails require lockout-policy checks before spraying, authorization and restoration checks for AD changes, single-account DCSync proof, scope enforcement, cross-model voting, and raw evidence receipts.Golden ticket forging is reported as a risk rather than executed.Source: D. Guardrail Architecture · p. 4

A. GOAD Lab Configuration

  • The GOAD v2 lab used five Windows Server 2019 virtual machines across three domains and two forests, with planted vulnerabilities verified after provisioning.The attack machine used Kali Linux in a sandbox container without host networking or a socket mount.Source: A. GOAD Lab Configuration · p. 4

B. NeuroSploit Configuration

  • The scope configuration names the three GOAD domains, sets persistence to detect-only, disables destructive verbs, and limits DCSync proof to one account.The configuration also lists no excluded targets.Source: B. NeuroSploit Configuration · p. 5

C. Engagement Commands

The engagement starts from low-privilege assumed-breach credentials and runs autonomously under a fixed experimental protocol. The same harness configuration was applied across nine models.

C. Engagement Commands

  • Each model was run in host mode with AD-specific targeting, starting from a low-privilege user credential in sevenkingdoms.local that authenticated across the forest.The engagement command used the GOAD scope and credentials configuration.Source: C. Engagement Commands · p. 5

D. Experimental Protocol

  • Three independent runs were conducted per model-condition pair, with clean lab restores, temperature fixed at 0.0, an eight-hour timeout, and no human intervention.Reported table and figure values are medians; remaining variance came from network timing, tool order, and Kerberos ticket lifetimes.Source: D. Experimental Protocol · p. 5

E. Multi-Model Evaluation

  • Beyond the Claude Opus family, six additional frontier models were evaluated in the harness under identical configuration, scope, and initial credentials; the same agents, validators, and guardrails applied across providers.Source: E. Multi-Model Evaluation · p. 5

F. Direct Model Baseline

The benchmark compares unstructured direct prompting with NeuroSploit’s harness on GOAD using shared evaluation metrics. Harness configurations maintained high technique coverage and chain completion across models, while direct prompting covered fewer techniques and missed complex chains.

F. Direct Model Baseline

  • The baseline gave each model the same initial credentials, target information, and Kali tools, but no structured prompts, chain orchestration, guardrails, or cross-model validation.The evaluation measured technique coverage, chain completion, precision, time to compromise, token cost, and guardrail activations.Source: F. Direct Model Baseline · p. 5, G. Evaluation Metrics • · pp. 5–6

A. Attack Technique Coverage

  • GPT-6 Astra achieved 100% coverage, 100% chain completion, and 100% precision, with the fastest time to compromise at 118 min.GPT-5.6 Sol, Grok 4.6, GLM 5.3, and Opus 4.8 each achieved 100% coverage and chain completion with 96.9% precision.Source: A. Attack Technique Coverage · p. 6
  • Harness coverage ranged from 96.4–100%, versus 21–54% for direct prompting, with the harness’s narrow performance spread attributed to its architecture.Simpler attacks succeeded without the harness, while complex multi-step techniques showed the largest gap.Source: A. Attack Technique Coverage · p. 6, Figure 4 · p. 6

B. Multi-Stage Chain Completion

  • Harness-orchestrated chains achieved 91.7–100% completion, while direct Opus 4.8 completed only 25% of stages and never attempted four complex chains.Opus 4.6 missed one stage in each of two chains after tool-syntax errors exceeded the stage timeout.Source: B. Multi-Stage Chain Completion · p. 6

C. Precision and False Positives

The harness produced high-precision findings, faster domain compromise, and a broader severity distribution than direct prompting. The case study illustrates how coordinated agents and automatic credential forwarding can complete a multi-stage path.

C. Precision and False Positives

  • The harness achieved 90.0–96.9% precision across models, while direct runs produced 7–9 false positives per run, often from hallucinated output, misread errors, or assumed credential validity.Cross-model voting and deterministic validators caught most false positives before the final report.Source: C. Precision and False Positives · p. 7, Figure 7 · p. 8

D. Time to Compromise

  • Opus 4.8 completed the three-domain engagement in 134 minutes, compared with 182 minutes for Opus 4.6; direct runs took 3–5× longer when achieving comparable coverage.The cross-forest domain took longer due to trust enumeration and reasoning about SID history and trust-key attacks.Source: D. Time to Compromise · p. 7, Figure 8 · p. 8

E. CVSS Severity Distribution

  • Five harness findings were Critical (CVSS ≥9.0), including DCSync rights, AD CS ESC1, a cross-forest trust bypass, and an MSSQL linked-server RCE chain.Scores were evidence-graded using demonstrated attack complexity, privileges required, and scope change.Source: E. CVSS Severity Distribution · p. 8, Figure 9 · p. 8

A. Path 1: Kerberoast to Domain Admin (sevenkingdoms.local)

  • A representative path took 18.7 minutes and coordinated four agents, automatically forwarding the relay agent’s PFX certificate to the PKINIT agent.The path ended with DCSync proof using a single decoy account.Source: A. Path 1: Kerberoast to Domain Admin… · p. 9

C. Path 3: Cross-Forest Trust Abuse (essos.local)

The case studies describe multi-agent attack paths across GOAD’s domains and forests, including cross-forest trust abuse and RBCD delegation abuse. They report successful compromise outcomes alongside the preconditions and state changes involved.

B. Path 2: Coercion + Relay + AD CS to Domain Admin (north.sevenkingdoms.local)

  • The coercion-relay path identified disabled SMB signing, vulnerable AD CS web enrollment, and PetitPotam exposure as preconditions.The AD CS agent confirmed an ESC1-classified template, and the coercion agent forced DC02 to authenticate to the relay listener.Source: B. Path 2: Coercion + Relay + AD CS to… · p. 9

C. Path 3: Cross-Forest Trust Abuse (essos.local)

  • The cross-forest path confirmed Enterprise Admin access to the essos.local domain controller and full compromise through single-account DCSync.The path used a bidirectional trust with partially disabled SID filtering, recovered the inter-realm trust key, and forged a referral ticket carrying Enterprise Admin SID history.Source: B. Path 2: Coercion + Relay + AD CS to… · p. 9

B. Path 2: Coercion + Relay + AD CS to Domain Admin (north.sevenkingdoms.local)

  • The cross-forest trust-abuse path took 14.3 minutes from initial enumeration and demonstrated compromise of a second forest through a SID-filtering bypass.The text characterizes this as the engagement’s highest-impact finding.Source: B. Path 2: Coercion + Relay + AD CS to… · p. 9

D. Path 4: RBCD + S4U Delegation Abuse

  • The RBCD path used GenericWrite on SRV02$ to configure delegation, then recorded the prior attribute value and documented restoration.The state-change guardrail activated before modifying the delegation attribute.Source: D. Path 4: RBCD + S4U Delegation Abuse · pp. 9–10

VII. GUARDRAIL ANALYSIS

During the Opus 4.8 GOAD engagement, guardrails intervened on scope, state changes, evidence quality, and DCSync operations. The vulnerability mapping reports how many planted vulnerabilities the evaluated Opus models discovered.

VII. GUARDRAIL ANALYSIS

  • The guardrail system activated 23 times during the Opus 4.8 engagement, while the unconstrained baseline attempted lockout-triggering sprays, a full NTDS dump, and scans outside scope.The harness limited DCSync to single-account proof and used lockout-aware throttling.Source: §VII · p. 10, E. Path 5: DPAPI Credential Looting · pp. 10–11
  • Seven state-change gate activations included two blocked operations: an out-of-scope SPN change and an RBCD modification lacking recorded pre-change state.Five other activations authorized changes after recording the prior state.Source: E. Path 5: DPAPI Credential Looting · p. 10

E. Path 5: DPAPI Credential Looting

  • DPAPI looting recovered two cleartext passwords and three Chrome credentials, while an out-of-scope RDP credential was flagged but not used.The findings were rated CVSS 6.5–7.8 because local administrator access was a prerequisite; recovered credentials were linked to additional lateral-movement paths.Source: E. Path 5: DPAPI Credential Looting · p. 10

VII. GUARDRAIL ANALYSIS

  • Six findings were demoted to unconfirmed for missing raw tool receipts, including unsupported BloodHound paths and an MSSQL access claim without authentication evidence.Four narrative-plausible claims were also rejected by cross-model voting.Source: E. Path 5: DPAPI Credential Looting · pp. 10–11

A. Vulnerability Catalog

  • GOAD’s 14 technique categories yielded 31 harness findings, with the table listing 22 representative unique misconfigurations and nine additional instances.The mapping was presented to validate that coverage corresponded to planted vulnerabilities and support reproduction.Source: A. Vulnerability Catalog · p. 11, §VIII · p. 11

B. Discovery Rate by Domain

  • Opus 4.8 discovered all 31 planted vulnerabilities, compared with 29 (93.5%) for Opus 4.7 and 27 (87.1%) for Opus 4.6.The weaker models missed different findings, including GPO abuse, an MSSQL detail, PetitPotam coercion, and AD CS ESC8.Source: B. Discovery Rate by Domain · p. 11

C. Attack Path Graph

The harness finds parallel routes to Domain Admin and analyzes token costs and direct-prompting failures. Direct prompting commonly skips available techniques and produces other validation errors, while harness costs and token use vary with model capability.

C. Attack Path Graph

  • Two parallel routes—Kerberoast+ACL and AS-REP+MSSQL—converge at Domain Admin, with an extension to essos.local.The authors note that alternatives matter because remediating one path may leave others open.Source: Figure 11 · p. 11, C. Attack Path Graph · p. 11

A. Token Consumption Breakdown

  • Opus 4.8 used 34% fewer total tokens than Opus 4.6: 13.9M versus 21.0M.The figure attributes the difference to improved first-attempt success rates.Source: Figure 12 · p. 11
  • Exploitation consumed 30–36% of tokens across models, while chain orchestration used 24–26% and validation 16–20%.Exploitation involved multi-turn tool interactions; validation was described as a fixed architectural cost that pays for itself through false-positive elimination.Source: A. Token Consumption Breakdown · pp. 11–12

B. Cost-per-Finding Analysis

  • Harness configurations cost $2.68–$3.63 per confirmed finding, while direct Opus 4.8 cost $8.26 per finding.The passage attributes the harness range to newer models using fewer tokens on retries and hallucinated output, and the direct-run cost to hallucinated findings and unstructured exploration.Source: B. Cost-per-Finding Analysis · p. 12, Table IV · p. 12

IX. TOKEN EFFICIENCY AND COST ANALYSIS

  • The cost comparison with human testing is illustrative: the GOAD lab’s deliberately vulnerable nature inflates autonomous coverage relative to production.The comparison also notes that human testers provide judgment, communication, and remediation guidance that autonomous tools do not.Source: B. Cost-per-Finding Analysis · p. 13

C. API Cost Projections

  • For 50 domain controllers across 10 domains and 5 forests, the estimate is 70–112M tokens and $560–$900 with Opus 4.8.The projection assumes agent selection scales sublinearly with domain count and chain orchestration linearly with distinct trust boundaries.Source: C. API Cost Projections · p. 13

A. Direct Prompting Failure Taxonomy

B. Harness-Mitigated vs. Residual Failures

The harness validation pipeline would catch most direct-prompting failures, while agent selection and staged orchestration address failures that validation alone cannot catch. The section also describes recon-driven agent selection, chain prioritization, and backtracking after a failed stage.

B. Harness-Mitigated vs. Residual Failures

  • The validation pipeline would catch 171 of 193 direct-prompting failures (89%), but skipped techniques and rabbit holes require agent selection and orchestrator backtracking.Three false positives still penetrated the Opus 4.8 harness run; all involved technically correct output interpreted with slightly incorrect scope.Source: B. Harness-Mitigated vs. Residual… · p. 13

A. Recon-Driven Selection

  • Recon signals activated technique-specific agents, while unsupported agents were left inactive to avoid irrelevant attempts and wasted tokens.Signals included disabled SMB signing, roastable accounts, an AD CS endpoint, delegation, and a cross-forest trust; absent LLMNR traffic and ZeroLogon/noPac indicators left those agents inactive.Source: §XI · p. 14, A. Recon-Driven Selection · p. 14

B. Chain Selection Logic

  • Chain selection prioritized fully satisfied prerequisites, then partially satisfied ones, and deferred chains requiring new enumeration or credential recovery.The GOAD engagement deployed the Kerberoast-to-DA chain first, then coercion-relay-ADCS, and finally cross-forest abuse.Source: B. Chain Selection Logic · p. 14

C. Backtracking and Alternative Path Selection

  • When a chain stage failed, the orchestrator recorded the error, chose an alternative path, and deferred the failed chain for a later attempt.In the Opus 4.6 run, it switched from a relay chain missing the -template flag to cross-forest abuse, then retried the relay chain successfully.Source: C. Backtracking and Alternative Path… · p. 14

XII. EVIDENCE QUALITY AND CVSS FIDELITY

  • The evidence-quality analysis assesses the quality of evidence supporting findings across three dimensions.The section frames this as relevant to the quality and defensibility of a penetration-testing report.Source: §XII · p. 14

A. Receipt Completeness

Harness orchestration substantially narrows model-performance differences relative to direct prompting, while receipt grounding, evidence-based scoring, and technique-specific remediation address report quality. The benchmark still shows weaker chain completion and precision for some models, with syntax errors on less common operations as a recurring issue.

A. Receipt Completeness

  • 89% of findings had complete receipts, 8% partial receipts, and 3% reference receipts; all confirmed findings had at least a partial receipt.Six findings were demoted to unconfirmed because they lacked receipts entirely.Source: A. Receipt Completeness · p. 14

B. CVSS Evidence Grading

  • Evidence-derived CVSS scoring had a mean absolute error of 0.12, compared with 0.74 for direct-prompting scores assigned by vulnerability class.The largest harness deviations were 0.3 points for SMB-signing findings and 0.2 for delegation findings.Source: B. CVSS Evidence Grading · pp. 14–15, Figure 14 · p. 15

C. Report Structure and Remediation Quality

  • Direct prompting produced generic remediation in 72% of findings, compared with 0% in harness output.Harness recommendations were technique-specific, including AD CS template changes and SID-filtering guidance for cross-forest trusts.Source: C. Report Structure and Remediation… · p. 15

B. Why the Harness Matters

  • Specialized agents, stage-by-stage proof requirements, and guardrails address technique selection, chain progression, and unsafe commands.Without the harness, all three direct-prompted models issued at least one command that would trigger account lockout in production; two runs attempted full NTDS dumps.Source: B. Why the Harness Matters · p. 15

C. Multi-Model Analysis

  • GPT-6 Astra achieved 100% coverage, chain completion, and precision with a 118-minute time to compromise; Tier 2 models reached 100% coverage and chain completion with 96.9% precision.Tier 3 models had 96.4–100% coverage, 94.4–97.2% chain completion, and 93.5% precision; Opus 4.6 recorded 96.4% coverage, 91.7% chain completion, and 90.0% precision.Source: C. Multi-Model Analysis · pp. 15–16

A. Summary of Key Findings

D. Comparison with Prior Work

NeuroSploit is compared with COCHISE and discussed for production deployment and autonomous-tool design, emphasizing broader assessment, architectural validation and safety, and deployment boundaries.

D. Comparison with Prior Work

  • NeuroSploit evaluates 14 technique categories and 7 multi-stage chains, whereas COCHISE demonstrated account compromise as a single-technique result.The authors frame this as broader coverage of the AD kill chain.Source: D. Comparison with Prior Work · p. 16
  • Deterministic CWE validators and belief gates provide model-independent validation, while Rust-level guardrails check authorization on every state-changing operation.The authors qualify that no system can claim absolute non-bypassability.Source: D. Comparison with Prior Work · p. 16

E. Production Deployment Considerations

  • Production defensive tools may detect many exercised techniques; NeuroSploit deliberately omits evasion so its activity can validate whether those controls trigger.The text names EDR, SIEM, and behavioral analytics as examples of production defenses.Source: E. Production Deployment Considerations · p. 17
  • For 40 domains, the authors estimate 4–6 hours with Opus 4.8; agent selection scales sublinearly with domain count, but chain orchestration scales linearly with trust boundaries.Reconnaissance data is reused across related domains.Source: E. Production Deployment Considerations · p. 17
  • The harness supports NT-hash, ccache, and certificate authentication, but initial access is unbenchmarked; organizational approval workflows may also require integration beyond its current legal and compliance primitives.The authors note that production engagements may begin with a single phishing-captured hash.Source: E. Production Deployment Considerations · p. 17

F. Implications for Autonomous Pentest Tool Design

  • The authors recommend separating orchestration from generation, noting that the same model covers 100% of attack paths within the harness and 54% without it.They characterize the gap as reflecting structured methodology versus unconstrained reasoning, not model scaling alone.Source: F. Implications for Autonomous Pentest… · p. 17
  • Prompt-based verification instructions did not measurably improve direct-prompting precision, while architectural validation eliminated false positives for the best-performing configuration.The specified architectural mechanisms include deterministic CWE validators, cross-model voting, and belief gates.Source: F. Implications for Autonomous Pentest… · p. 17
  • Structured markdown playbooks specialize agents without modifying models, supporting technique expansion in hours rather than weeks and portability across capable LLMs.The authors contrast adding an agent with fine-tuning a model.Source: F. Implications for Autonomous Pentest… · p. 17

G. Threat Model and Dual-Use Considerations

The paper discusses dual-use risks and ethical safeguards, then gives deployment and command details intended to support replication of the GOAD engagement.

G. Threat Model and Dual-Use Considerations

  • Encoding expert AD methodology lowers the skill barrier for both legitimate engagements and adversarial use, while the encoded techniques are already publicly documented.The authors characterize the harness contribution as orchestration and validation, not novel attack techniques.Source: G. Threat Model and Dual-Use… · pp. 17–18
  • Guardrails support authorized testing but are not a barrier to misuse, since an adversary could fork the harness and remove them; commercial LLM providers also apply their own safety policies and monitoring.The guardrails provide positive utility to authorized testers by preventing lockouts, maintaining scope, and supporting evidence quality.Source: G. Threat Model and Dual-Use… · p. 18

H. Ethical Considerations

  • Experiments used only the deliberately vulnerable GOAD lab, with no production systems, real user credentials, or live enterprise networks; the lab was destroyed and sensitive artifacts were not released.The authors state alignment with an ethical framework requiring authorization verification, scope enforcement, and human oversight capability.Source: H. Ethical Considerations · p. 18

XIV. REPRODUCIBILITY GUIDE

  • The reproducibility guide describes public GOAD deployment options and automatic vulnerability provisioning, and lists the required harness, Kali tools, credentials, scope file, and Anthropic API access.The complete engagement command uses Opus 4.8 and three votes.Source: §XIV · p. 18
  • The guide documents revalidation and compliance flags, tool versions, and output artifacts including findings, SARIF reports, audit trails, and BloodHound data.The audit trail is hash-chained, and the revalidation flag reruns proofs of concept and demotes findings that fail.Source: §XIV · p. 18

XV. LIMITATIONS

NeuroSploit outperforms direct invocation in the benchmark, but conclusions are bounded by GOAD's lab setting and assumptions about topology, starting access, validation depth, and model reproducibility.

XV. LIMITATIONS

  • GOAD is deliberately vulnerable, unlike production AD environments with hardened baselines, EDR, segmentation, and incident response; coverage would likely be lower against a Tier-2 SOC.Source: §XV · p. 19
  • Continuously updated frontier-model endpoints may change behavior, so pinned identifiers and API versions cannot guarantee bit-identical reproduction; stochastic-decoding variance was not measured.Source: §XV · p. 19
  • The benchmark covers one GOAD topology; SID filtering, selective-authentication trusts, or tiered administration may expose failure modes not captured here.Source: §XV · p. 19
  • Engagements began with valid low-privilege credentials, leaving phishing, client-side exploitation, and network poisoning for initial access outside scope.Source: §XV · p. 19
  • Some techniques were validated only to demonstrated capability, so coverage measures reachability rather than completable exploitation and may slightly overstate unconstrained autonomous performance.Source: §XV · p. 19

XVI. CONCLUSION

  • 96–100% coverage across 14 attack-technique categories versus 21–54% for direct invocation; across models, coverage spread narrowed from ∼2.5× to ∼1.04×.Source: §XVI · p. 19
  • The authors identify harness architecture—not model capability—as the critical missing component; the same model covers 100% of attack paths within the harness and 54% without it.Source: §XVI · p. 19
  • Future work proposes broader testbeds, evasion-aware agents, Rave severity scoring, human-selected attack paths, and cost-optimized model routing.Source: §XVI · p. 19
Loading 2610.04243v1…