VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents¶

🕒 Published (v1): 2026-07-10 17:52 UTC · Source: Arxiv · link

Why this paper was selected

Autonomous vulnerability exploitation agents; structured multi-step agentic harness for security testing

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

VEXAIoT is an autonomous multi-agent framework that combines a vulnerability detection agent and an attack execution agent to perform end-to-end IoT penetration testing—reconnaissance through exploitation—using LLM reasoning over nmap/searchsploit outputs. Evaluated across 260 executions in IoTGoat and Metasploitable2 environments, it achieves a 95.0% overall attack success rate with sub-two-minute median execution times. The work extends LLM-based offensive automation from CTF/generic pentesting into IoT-specific OWASP threat categories.

Problem¶

Existing autonomous LLM pentesting agents (PentestGPT, AutoAttacker) target structured CTF challenges or generic penetration-testing workflows and do not address IoT-specific attack surfaces. Rule-based IoT security automation systems (e.g., prior OWASP IoT scanners) can identify vulnerabilities but cannot adaptively exploit them or adjust plans based on execution feedback. Manual IoT security testing on platforms like IoTGoat does not scale. There is no prior autonomous framework covering all OWASP IoT Top 10 vulnerability classes end-to-end.

Method¶

VEXAIoT uses a two-agent pipeline orchestrated by the vulnerability detection agent:

Detection agent runs nmap on the target IP, queries searchsploit per detected service/version to retrieve CVE-matched exploit scripts, then constructs a prompt (with role framing, tool capability descriptions, and attack dependency constraints) for GPT-o3/ChatGPT 5.1 thinking to generate an ordered attack sequence.
Attack execution agent receives per-attack instructions (vulnerability context, target port, exploit script path) via a generic prompt, generates bash commands, executes them on the Kali attacker VM, and returns stdout/stderr.
The detection agent validates outcomes using attack-specific success criteria (Table I: passive attacks confirm credential/data capture; active attacks confirm service disruption, file modification, or access success). On failure, it passes the error back to the execution agent for retry with a modified strategy. Attacks without dependencies can be parallelized by launching multiple execution agent instances simultaneously.

The prompt design avoids explicitly labeling tools as malicious—instead describing functional capabilities—to reduce LLM refusal rates. Attack dependencies (e.g., credential recovery before authenticated attacks) are encoded in the detection prompt and enforced via local state storage on the attacker machine.

Evaluation environments: IoTGoat (OpenWrt-based intentionally vulnerable router firmware, 10 attack scenarios covering 9 OWASP IoT Top 10 categories) and Metasploitable2. Each attack run 20 trials (260 total executions).

Key Contributions¶

Multi-agent framework (detection + execution agents) for fully autonomous IoT vulnerability assessment and exploitation, covering all OWASP IoT Top 10 categories.
Vulnerability detection agent that chains nmap + searchsploit into LLM-driven attack sequence planning with dependency resolution.
Attack execution agent that generates and runs exploit commands, handles retries with modified strategies on failure, and supports parallel execution for independent attacks.
Prompt engineering approach using functional tool descriptions and role framing to reduce LLM refusals in offensive security contexts.
Evaluation across 10 heterogeneous OWASP IoT attack scenarios (MitM credential grab, hardcoded password recovery, UPnP/developer backdoors, XSS, RCE, malicious firmware update, DNS DoS, database PII extraction, log erasure) in a reproducible 3-VM testbed.

Results¶

Overall success rate: 95.0% across 260 attack executions.
IoTGoat: 94.5% success rate.
Metasploitable2: 96.7% success rate.
Individual attack success rate: up to 100% for most attacks over 20 trials.
Average execution time: under 2 minutes for most attacks.
Token overhead described as "low" (no specific token counts reported in available text).

Limitations¶

Evaluated exclusively in isolated, intentionally vulnerable virtualized environments (IoTGoat, Metasploitable2); generalizability to real heterogeneous IoT deployments is unvalidated.
Assumes attacker already has network-level access to the target; initial access and lateral movement are out of scope.
Relies on searchsploit's Exploit Database for CVE mapping—vulnerabilities with no public exploit scripts are not handled.
"Lack of Physical Hardening" OWASP category is excluded by design (firmware/network scope only).
No comparative baseline against other autonomous pentesting agents (e.g., PentestGPT, AutoPentester) on the same IoT scenarios.
Results section is truncated in the provided text; full per-attack breakdown and token cost data are not available for assessment.

Relevance to Harnesses / Meta-Harnesses¶

VEXAIoT is a concrete domain-specific harness that instantiates the detection-orchestrator / execution-subagent pattern common to agentic meta-harnesses: a controller agent decomposes a task (attack planning), dispatches specialized subagents (exploit execution), processes their outputs, and loops with retry logic and dependency enforcement. The explicit separation of orchestration (detection agent) from execution (attack agent) with structured inter-agent communication via parsed outputs mirrors the modular pipeline architecture seen in general-purpose harness frameworks. The paper's prompt engineering techniques—role framing, functional capability descriptions, dependency injection via prompt variables—are directly portable to harness design for other tool-using LLM pipelines. For harness researchers, this work provides a reproducible case study of how retry handling, parallel execution gating on dependency satisfaction, and attack-specific validation criteria can be encoded in a two-agent loop.