AutoPentester: An LLM Agent-based Framework for Automated Pentesting

2025-10-07 · Yasod Ginige, Akila Niroshan, Sajal Jain, Suranga Seneviratne arxiv

Penetration testing and vulnerability assessment are essential industry practices for safeguarding computer systems. As cyber threats grow in scale and complexity, the demand for pentesting has surged, surpassing the capacity of human professionals to meet it effectively. With advances in AI, particularly Large Language Models (LLMs), there have been attempts to automate the pentesting process. However, existing tools such as PentestGPT are still semi-manual, requiring significant professional human interaction to conduct pentests. To this end, we propose a novel LLM agent-based framework, AutoPentester, which automates the pentesting process. Given a target IP, AutoPentester automatically conducts pentesting steps using common security tools in an iterative process. It can dynamically generate attack strategies based on the tool outputs from the previous iteration, mimicking the human pentester approach. We evaluate AutoPentester using Hack The Box and custom-made VMs, comparing the results with the state-of-the-art PentestGPT. Results show that AutoPentester achieves a 27.0% better subtask completion rate and 39.5% more vulnerability coverage with fewer steps. Most importantly, it requires significantly fewer human interactions and interventions compared to PentestGPT. Furthermore, we recruit a group of security industry professional volunteers for a user survey and perform a qualitative analysis to evaluate AutoPentester against industry practices and compare it with PentestGPT. On average, AutoPentester received a score of 3.93 out of 5 based on user reviews, which was 19.8% higher than PentestGPT.

📄 PDF Abstract BibTeX arXiv:2510.05605

Code (0)

등록된 구현이 없습니다.

Autonomous Penetration Testing using Reinforcement Learning

2019-05-15 · Jonathon Schwartz, Hanna Kurniawati

Penetration testing (pentesting) involves performing a controlled attack on a computer system in order to assess it's security. Although an effective method for testing security, pentesting requires highly skilled practi…

Q-Learning reinforcement-learning Reinforcement Learning Reinforcement Learning (RL)

Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents

2026-07-22 · Or Zion Eliav, Eyal Lenga, Shir Bernstien, Yisroel Mirsky arxiv

Traditional pentesting uses reconnaissance at each step to uncover unseen weaknesses, build stronger attacks, and advance the objective; we argue that AI agents require the same treatment. We formalize agent reconnaissan…

RapidPen: Fully Automated IP-to-Shell Penetration Testing with LLM-based Agents

2025-02-23 · Sho Nakatani

We present RapidPen, a fully automated penetration testing (pentesting) framework that addresses the challenge of achieving an initial foothold (IP-to-Shell) without human intervention. Unlike prior approaches that focus…

Task Planning

ARACNE: An LLM-Based Autonomous Shell Pentesting Agent

2025-02-24 · Tomas Nieponice, Veronica Valeros, Sebastian Garcia

We introduce ARACNE, a fully autonomous LLM-based pentesting agent tailored for SSH services that can execute commands on real Linux shell systems. Introduces a new agent architecture with multi-LLM model support. Experi…

Mind the Gap: Towards Generalizable Autonomous Penetration Testing via Domain Randomization and Meta-Reinforcement Learning

2024-12-05 · Shicheng Zhou, Jingju Liu, Yuliang Lu, Jiahai Yang 외

With increasing numbers of vulnerabilities exposed on the internet, autonomous penetration testing (pentesting) has emerged as a promising research area. Reinforcement learning (RL) is a natural fit for studying this top…

Large Language Model Meta Reinforcement Learning Reinforcement Learning (RL)