Technical Summary: CAESAR – A Coordinated Multi-Agent Framework for Automated Cyber Intrusions

1. Problem Statement

Large Language Models (LLMs) have demonstrated capability in offensive security tasks, such as vulnerability triage and exploit drafting. However, current single-agent approaches compress the entire intrusion workflow—evidence extraction, planning, execution, and validation—into a single conversational context. This compression leads to context drift, error propagation, and hallucination, particularly in complex, multi-stage campaigns like Advanced Persistent Threats (APTs).

Real-world intrusion campaigns require interdependent phases (reconnaissance, hypothesis formation, exploit construction, post-compromise activity) that exceed the practical token budget and memory coherence of a single LLM call. Existing multi-agent systems often focus on general collaboration or debate but fail to explicitly model the role boundaries, artifact provenance, and strict cost constraints (token, time, risk) necessary for adversarial, multi-stage reasoning. Consequently, single-agent pipelines often collapse into trial-and-error sequences that fail to converge in heterogeneous domains like binary analysis or algebraic inference.

2. Methodology: The CAESAR Framework

The paper presents CAESAR (Coordinated Adversarial Execution and Strategic Reasoning), a coordinated multi-agent framework designed to operationalize intrusion-style workflows through a structured, round-based protocol.

A. Formal Model and Architecture

CAESAR is formalized as a tuple $F = \langle R, E, K, W, \Pi, V \rangle$, operating over a target environment $E$ with a bounded operational budget $\Gamma = \langle c_{tok}, c_{time}, c_{risk} \rangle$. The framework decomposes the workflow into five typed role operators:

1. Detective (D): Extracts salient features and evidence from the target environment.
2. Strategist (S): Organizes evidence into hypothesis graphs, constructing alternative solution pathways.
3. General (G): Evaluates hypotheses against the budget vector and selects an executable plan, assigning actions to specific executors.
4. Executor (E): Invokes domain-specific tools (e.g., debuggers, disassemblers) to execute atomic actions.
5. Validator (V): Inspects execution traces, validates outcomes, and gates the promotion of reliable patterns to a persistent knowledge base.

B. The Round Protocol

The framework executes in discrete rounds, each proceeding through six stages:

1. Initialization: A read-only snapshot of the persistent knowledge base ($K$) is created for the round.
2. Evidence Collection: The Detective issues bounded observation actions, generating structured evidence artifacts.
3. Hypothesis Construction: The Strategist builds a hypothesis graph using current evidence and reusable patterns from $K$.
4. Plan Formation: The General scores hypotheses using a utility function $U_G$ that balances success probability against token, time, and risk costs. A plan is negotiated and assigned to executors.
5. Task Execution: Executors invoke tools and emit structured traces.
6. Evaluation & Promotion: The Validator scores all artifacts. Only those exceeding a promotion threshold $\tau_{prom}$ are committed to the persistent knowledge base $K$ as typed entries (Patterns, Capabilities, or Feedback).

C. Key Mechanisms

• Validator-Gated Knowledge Promotion: To prevent error amplification, only validated, high-confidence artifacts are promoted to $K$. This ensures that subsequent rounds build on verified observations rather than hallucinated states.
• Typed Artifacts and Provenance: Every artifact carries a type, content hash, and provenance link, allowing the Validator to audit intermediate products against specifications.
• Budget-Aware Planning: The General explicitly optimizes for a trade-off vector, ensuring plans remain within token, time, and risk limits.
• Write Isolation: Roles have isolated write access to their specific workspace partitions, with the Validator acting as the sole writer to the shared knowledge base.

3. Key Contributions

1. Framework Proposal: The introduction of CAESAR, which operationalizes role specialization, validator-gated memory, and budget-aware planning under a formal typed round protocol.
2. Systematic Evaluation: A comprehensive evaluation on 25 real-world CTF challenges (Reverse, Pwn, Crypto, Misc, Web) across four contemporary LLM backends (GPT-5, Gemini 2.5, Grok-4, DeepSeek-R1).
3. Generalization Study: A secondary study demonstrating that the coordination pattern transfers to social-engineering infiltration scenarios, achieving higher extraction success and lower detection risk than single-agent baselines.
4. Defensive Insights: Empirical evidence suggesting that coordination structure, rather than raw model capability, drives emergent attack strength, implying a need for structural monitoring of role dynamics.

4. Results and Analysis

The evaluation compared CAESAR against single-agent baselines under identical tool access and budget constraints.

• Success Rates and Efficiency: CAESAR consistently improved task success rates and reduced time-to-solve across all five CTF categories. For example, on the Reverse category with GPT-5, the success rate improved by +0.36, and solving time dropped from ~54 minutes (single-agent) to ~24 minutes (multi-agent).
• Adaptive Behavior: The framework demonstrated adaptive learning. Performance stabilized after a small number of successful rounds, with the Validator-gated memory suppressing error amplification. Role scores (assigned by the Validator) showed reconfiguration near successful runs, indicating the system learned from validated feedback.
• Backend Agnosticism: The benefits of coordination were consistent across all four LLM backends. While raw performance varied by model (e.g., Grok-4 showed higher reasoning scores on Crypto tasks), the relative gain provided by the multi-agent structure was stable. This suggests the improvement stems from the coordination protocol rather than specific model capabilities.
• Social Engineering Transfer: In the social-engineering study, the multi-agent team achieved 3/3 secrets obtained without detection by Round 10, whereas the single-agent baseline achieved only 1/3. The multi-agent approach successfully shifted from direct probing (which triggered detection) to indirect elicitation strategies.

5. Significance and Claims

The paper claims that coordination, rather than raw model intelligence, is the dominant factor in the observed attack effectiveness.

• Structural Vulnerability: The findings suggest that future AI-driven adversaries will likely manifest as distributed ensembles exchanging partial information and refining strategies across rounds, rather than singular "superintelligent" instances.
• Defensive Implications: Current content-level safeguards (input/output filters, alignment layers) are insufficient because they evaluate messages in isolation. A coordinated attacker distributes intent across roles and rounds, making the harmful signal emerge only when messages are correlated.
• Shift in Defense: The authors argue that defense must shift from content-based filtering to structural monitoring of role dynamics, artifact provenance, and cross-message strategy formation. The protocol-level signals externalized by CAESAR (e.g., repeated references to protected entities across agents, gradual role specialization) are proposed as the necessary quantities for structural defense.

Limitations Acknowledged

The authors explicitly note that:

• CTF challenges are simplified proxies for real intrusions, lacking active defenders and persistent constraints.
• The framework has not been tested against live, hardened production systems.
• The social-engineering study used LLM-based personas, not real humans, limiting claims about operational effectiveness against actual human cognition.
• The protocol assumes cooperative agents; Byzantine or deceptive roles are out of scope.