Advances in AI agents improve automatic penetration testing success
Big Enough to Break Out: Tracking the Rising Capability of LLM Penetration-Testing Agents
Cryptography and Security
Summary
Testing computer security by finding weaknesses is easier with AI helpers called large language model agents. This study compares an older system using one AI model with human help to a newer, fully automatic system using a different AI. The newer system solves all test challenges, while the older one struggles but still makes partial progress. Surprisingly, the main problem for the AI is not forgetting clues but deciding how to use them to attack. This suggests future improvements in planning will boost AI hacking tools more than memory.
What this means in practice
- •For cybersecurity teams: Use progress tracking of AI agents to anticipate and measure emerging automated attack techniques for better defense preparation.
- •For software security engineers: Adopt AI-driven pen-testing tools that demonstrate effective autonomous vulnerability discovery and exploitation, reducing human effort.
Authors
Victoria Lovelace, Cameron Berryman, Yuhan You, Suhas Reddy Adavelly, Joel Sadler, Daniel Graham
Abstract
Large language model (LLM) agents are increasingly applied to penetration testing, but we still know little about what they can do or how they fail. We compare two PentestGPT-based systems: a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running Claude Opus 4.8. Across three public targets, the autonomous system solves all three, including the two the legacy system never finishes. The legacy result is the more surprising of the two. Even on the machines the legacy system fails to solve, it completes about half the subtasks, while running on ordinary university GPUs with no provider guardrails. We can describe the trend but not explain it, since model, harness, autonomy, and memory architecture all change together. Its direction still points to the next question: what will limit these agents as they take on more complex tasks? The usual answer is long-horizon memory, the loss of access to earlier findings during long attack chains. We test it by adding a coverage-memory layer to both systems, and neither improves outcomes. In the legacy stalled runs we could review, the limiting factor appeared to be planning and commitment rather than lost memory: agents held the evidence for a route forward and never turned it into a concrete exploitation hypothesis, which may suggest that offensive capability will advance with agents' ability to plan rather than with better memory. The same subtask scoring that tracks this capability is available to defenders, who can measure it as it rises instead of waiting to meet it in the field.