LLMs as Hackers: Autonomous Linux Privilege Escalation Attacks

1. Problem Statement

Penetration testing (pen-testing) is critical for identifying system vulnerabilities, with privilege escalation (gaining elevated access, typically from a low-privilege user to root) being a complex, time-consuming subtask. While Large Language Models (LLMs) show promise in automating security tasks by emulating human behavior, there is a lack of empirical understanding regarding their efficacy, limitations, and cost-efficiency in autonomous Linux privilege-escalation scenarios.

Existing automated tools (e.g., linpeas, traitor) are often rule-based and lack situational awareness or the ability to reason through multi-step exploits. Conversely, prior LLM-based research often relied on human-in-the-loop systems, lacked reproducibility, or used "toy" benchmarks that did not reflect real-world constraints. The authors aim to fill this gap by evaluating the performance of off-the-shelf LLMs in fully autonomous attacks against a controlled, reproducible benchmark.

2. Methodology

2.1 The Benchmark (Testbed)

To ensure reproducibility and safety, the authors created a novel, open-source Linux privilege-escalation benchmark:

• Structure: A set of distinct Virtual Machines (VMs), each containing exactly one specific vulnerability.
• Vulnerability Classes: Includes SUID/Sudo misconfigurations, Docker group privileges, information disclosure (passwords in files, SSH keys, bash history), and time-dependent Cron jobs.
• Isolation: VMs are provisioned via Vagrant/Ansible on a local, air-gapped network to prevent external interaction and ensure a clean state for every run.
• Complexity: Designed to be solvable by human experts (75% success rate) but difficult for traditional automated tools (16% success rate).

2.2 The Prototype: hackingBuddyGPT

The authors developed a fully automated Python-based agent that:

• Connects to the target VM via SSH.
• Interacts with LLMs via API.
• Executes a control loop: Observe (command output) $\rightarrow$ Reason (LLM prompt) $\rightarrow$ Act (execute next command).
• Capabilities: The LLM can request execute_command or test_credentials.
• Context Management: The system supports different memory strategies:
  • History: Truncated shell history.
  • State (Reflection): An LLM summarizes the current "worldview" and facts after every step, replacing raw history to save context tokens.

2.3 Models Evaluated

The study tested a diverse range of models:

• Cloud-based: GPT-3.5-Turbo, GPT-4-Turbo (OpenAI).
• Open-weight/Local: Llama3-8b (Small Language Model), Llama3-70b (Quantized).
• Baselines: Human professional penetration testers (7 years experience) and traditional tools (traitor, pwncat-cs).

2.4 Experimental Variables

• Guidance: Testing the impact of High-Level Hints (e.g., "check for SUID binaries") vs. Enumeration-derived hints (LLM summarizing lse.sh output).
• Context Size: Comparing 4k, 8k, and 128k token limits.
• In-Context Learning (ICL): Injecting external knowledge (e.g., hacktricks documentation) into the prompt.

3. Key Contributions

1. Novel Benchmark: A publicly available, reproducible Linux privilege-escalation benchmark with single-vulnerability VMs, addressing the lack of standardized testbeds in this domain.
2. Autonomous Prototype: hackingBuddyGPT, a fully automated agent capable of running end-to-end attacks without human intervention.
3. Comprehensive Empirical Analysis: A quantitative and qualitative comparison of multiple LLMs against human experts and traditional tools, analyzing success rates, token costs, and command quality.
4. Strategic Insights: Evaluation of context management strategies (State vs. History), guidance mechanisms, and the feasibility of Small Language Models (SLMs) for offensive security.

4. Key Results

4.1 Quantitative Success Rates

• GPT-4-Turbo: Demonstrated the highest efficacy.
  • Unaided: Solved 33% of vulnerabilities.
  • With High-Level Guidance: Solved 83% (comparable to human experts at 75–91%).
  • State Management: Using the "Reflection" pattern (summarizing state) doubled the unaided success rate from 33% to 66%.
• GPT-3.5-Turbo: Moderate performance.
  • Unaided: 16%.
  • With Guidance: 50%.
• Llama3-70b: Limited success (25–33%), showing that even large open-weight models struggle without guidance.
• Llama3-8b: 0% success rate without assistance; struggled with syntax and hallucinating capabilities.
• Traditional Tools: Solved only 8–16% of cases, confirming they are less effective than advanced LLMs for complex reasoning tasks.

4.2 Qualitative Analysis & Limitations

• Command Quality: GPT-4 generated syntactically correct but sometimes convoluted commands. Llama3 often produced syntax errors or hallucinated non-existent commands (e.g., exec_cat).
• Common Sense & Reasoning:
  • LLMs struggled with temporal dependencies (e.g., Cron jobs requiring a wait time before exploitation).
  • They often failed to utilize "low-hanging fruit" (e.g., finding a password in a file but failing to use it to log in).
  • They lacked "experience" (e.g., not knowing that standard SUID binaries like passwd are rarely exploitable), leading to wasted rounds.
• Error Handling: LLMs frequently ignored error messages or repeated failed commands without adapting.

4.3 Cost Analysis

• GPT-4-Turbo: Achieved human-comparable performance at a cost of ~$1.54 per exploited vulnerability (using state management). This is competitive with professional pen-testing rates ($159/hr) when considering the volume of tests.
• GPT-3.5-Turbo: Significantly cheaper (~$0.43/vuln) but required high-level guidance to be effective.
• In-Context Learning: Adding external knowledge (ICL) increased costs substantially without significantly improving success rates for GPT-4, suggesting the model's internal knowledge is sufficient for these tasks.

5. Significance and Implications

• Feasibility of Autonomous Hacking: The study proves that advanced LLMs (specifically GPT-4) can autonomously perform privilege escalation at a level approaching human experts, posing a significant security risk if misused by bad actors.
• Defense Strategy: The distinct behavioral patterns of LLMs (e.g., ignoring errors, repetitive enumeration, lack of "common sense") can serve as signatures for detecting AI-driven attacks in security logs.
• Tooling Evolution: Traditional rule-based tools are insufficient for modern attacks. Future security tools must integrate reasoning capabilities (like LLMs) but require better error handling and temporal reasoning.
• Human-AI Collaboration: The most effective approach identified is a hybrid model: using a powerful (but expensive) model like GPT-4 for high-level planning/guidance and a cheaper model (GPT-3.5) for command execution, or using human guidance to steer the LLM.
• Ethical Note: The authors emphasize that while local models (Llama3-8b) are currently too weak for autonomous attacks, cloud models are capable. They release their data to help "Blue Teams" (defenders) prepare for these emerging threats.

Conclusion

The paper establishes that GPT-4-Turbo is currently the only LLM capable of autonomous Linux privilege escalation at a scale comparable to human professionals, provided it is supported by context management strategies (State/Reflection) or high-level guidance. While local models are not yet a threat, the rapid evolution of these models suggests that autonomous offensive capabilities will soon become more accessible, necessitating immediate updates to defensive strategies and detection mechanisms.