Jul 2026· Journal of Information & Knowledge Management· 0 citations
TL;DR
Results show that, within a controlled cyber-range environment, LLM-guided agents can approximate deterministic performance when appropriate constraints are applied, suggesting that agent-based approaches to offensive security can support semi-autonomous red teaming workflows, provided that decision-making is governed by structured control policies.
Abstract
Agentic artificial intelligence (AI) is increasingly being explored for automating offensive security and red teaming tasks, enabling systems that can coordinate multi-step cyber operations through structured decision-making. While prior research has investigated reinforcement learning (RL) agents and large language models (LLMs) for penetration testing, most studies are evaluated in simulated or abstract environments, with limited empirical validation in real cyber-range settings. This paper presents a controlled experimental evaluation of an LLM-guided offensive security pipeline against deterministic scripted baselines in a cyber-range environment. Using a vulnerable Kioptrix virtual machine and a Kali Linux attacker, we implement three deterministic pipelines, fixed-path, sequential and rule-based, alongside two configurations of an LLM-guided agent: an initial version (LLM V1) and a refined constrained controller (LLM V2). All approaches operate within a restricted and auditable action space executed through predefined tools. Across repeated trials, the initial LLM configuration exhibits reduced reliability and increased execution cost due to exploratory behaviour. In contrast, the refined controller achieves a 100% success rate, reduces execution steps, eliminates wasted actions and matches the efficiency of rule-based automation. These results show that, within a controlled cyber-range environment, LLM-guided agents can approximate deterministic performance when appropriate constraints are applied. This suggests that agent-based approaches to offensive security can support semi-autonomous red teaming workflows, provided that decision-making is governed by structured control policies.
CyberLLM is presented, a multi-agent, LLM-orchestrated framework that autonomously detects vulnerabilities and executes remediations under a formal, runtime safety guard, and indicates that LLM agents can perform useful autonomous cyber-defense when wrapped in a deterministic, auditable safety envelope.
Nenad Petrovic, Oussama Jeddou, Feres Ben Fraj et al.· 0 citations
LLM-driven autonomous agents are reshaping offensive security. Unlike traditional penetration-testing tooling - deterministic, narrowly scoped, and operated by trained practitioners - agentic security tools exhibit indeterminacy along three independent dimensions. First, their actions are drawn from a non-deterministic policy whose outputs resist both ex-ante and ex-post explanation. This complicates incident attribution and pre-deployment safety reviews. Second, their impact is open-ended due to their non-deterministic actions, agency of utilized models, and opaque LLM supply-chains. Third, their user population is indeterminate in both size and required skill: the operating skill floor for using or developing offensive capabilities has dropped sharply. These three properties are linked thematically, but are not derivable from one another. Combined with the structural cost asymmetry between offense and defense, they enable the industrialization of offensive capability. The net short-term effect favors attackers, even if the same technology may, in the long run, democratize access to defensive practice. Existing dual-use cybersecurity and AI-ethics frameworks struggle to address this combination. Our work analyzes how moral attribution becomes diffuse between users, tool-makers, and third parties when employing autonomous AI agents for offensive security. We also examine the stakeholder impact of this technology and provide stratified recommendations.
A. Happe, Jürgen Cito, Jasmin Wachter· 2 citations
Cyber-capable AI agents combine language models with tools, memory, and execution environments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthesizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and the speed of automated action. We use two separate preliminary incident records: the reported July 2026 Hugging Face/OpenAI evaluation breach and Anthropic's subsequent three-incident evaluation review. A comparative evidence protocol distinguishes record-specific factual claims from the shared systems lesson: the evaluation environment is itself part of the security boundary. Across the taxonomy and records, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised.
Empirical evaluations reveal a fundamental brittleness in existing defenses: with a single trainable 7B planner, Trident reduces blue agent defensive performance by an average of 522% compared to static red agent baselines while autonomously discovering emergent behaviors such as decoy avoidance and adaptive state prioritization that static heuristics entirely fail to uncover.
Ryozo Masukawa, Ian Bryant, Armita Kazeminajafabadi et al.· 0 citations
Aim/Purpose: The primary objective is to address the structural operational cost crisis in modern SOCs by designing and formally specifying a three-layer agentic AI framework that integrates semantic alert triage, adaptive reinforcement-learning response, and episodic knowledge synthesis into a unified architecture.
Background: Modern SOCs are experiencing an acute operational crisis. Exponential growth in alert volume, high false-positive rates (>40%), and chronic analyst attrition have created a perfect storm. Existing rule-based SIEM and single-agent SOAR approaches only achieve 20–55% alert automation and fail to address the full operational lifecycle.
Methodology: The framework evaluation is based on a structured comparison with seven benchmark systems across four dimensions (threat coverage breadth, integration completeness, cost quantification, and adversarial safeguards), each rated on a five-level ordinal scale using replicable criteria.
Contribution: The paper makes four contributions: (1) a formal algorithmic specification of a three-layer agentic AI architecture including three pseudocode procedures and a PPO state-action-reward formalism; (2) a quantitative operational cost projection framework explicitly distinguishing designed targets from measured performance, with a maximum designed workload reduction of 86%; (3) a systematic four-dimensional comparative analysis against seven benchmark frameworks demonstrating that CyberAgent is the only framework achieving full architectural completeness (integrating all three of semantic triage, adaptive RL response, and episodic knowledge synthesis simultaneously), an architectural claim requiring empirical confirmation; and (4) dual adversarial safeguards (prompt injection mitigation and reasoning consistency verification) absent from all seven benchmark frameworks.
Findings: CyberAgent is a theoretical design-science artefact that has neither been implemented nor empirically evaluated. All quantitative projections are designed to achieve targets grounded in prior work, not verified outcomes: an alert automation rate of 85–90%, an analyst workload reduction of 56–86% (design target 86% under the product-rule independence assumption), an MTTR reduction of 65–75%, and a false-positive reduction of 60–70%. These projections require empirical validation using CybORG and the DARPA OpTC dataset, with this as the primary future work priority.
Recommendations for Practitioners: The PTL’s Chain-of-Thought (CoT) reasoning traces provide human-readable decision narratives that enhance transparency and may support auditability workflows relevant to GDPR Article 33, HIPAA, PCI-DSS, and SOX. However, CoT traces do not automatically satisfy regulatory auditability or compliance requirements; they are one architectural input to a broader compliance process. Formal legal and compliance assessment by qualified professionals is required before deployment in regulated environments. Practitioners should treat CoT output as decision-support documentation, not as regulatory certification.
Recommendation for Researchers: Future work should also develop federated DRL training protocols to ensure policy convergence under data-scarce conditions and rigorously test the adversarial robustness of the PTL’s consistency-checking mechanism against novel prompt-injection strategies.
Impact on Society: If empirically validated, CyberAgent could make enterprise-grade cyber defence more accessible to mid-market organisations that cannot afford 24/7 SOC analyst staffing, by substantially reducing the alert-triage workload. All such impact claims are conditional on validation results.
Future Research: Priority directions include: (1) empirical implementation and red-team validation across diverse enterprise environments; (2) federated DRL training to address the data sharing constraints that limit policy learning in regulated sectors; (3) extension of the KSL to support cross-organizational threat intelligence sharing; and (4) longitudinal studies measuring analyst skill development and human-AI trust calibration under progressively increasing levels of CyberAgent autonomy.
S. Meeampol, Narongsak Sukma· Interdisciplinary Journal of...· 0 citations
RedAgentBench is introduced, an executable framework for autonomous red-teaming and faithful measurement that shows that executable evaluation can improve safety measurement and identify actionable intervention points.
Zixing Chen, Xingyuan Liu, Jie Zhu et al.· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
