Technical Summary: VEXAIoT – Autonomous IoT Vulnerability Exploitation using AI Agents

Problem Statement

Internet of Things (IoT) systems face inherent security challenges due to constrained hardware, outdated firmware, and insecure default configurations. These factors create a vast and heterogeneous attack surface that is difficult to secure. While traditional vulnerability scanning frameworks exist, they often rely on static rules or require significant manual effort from security professionals to adapt to diverse environments. Furthermore, existing Machine Learning (ML) approaches in IoT security predominantly focus on intrusion detection, anomaly detection, and threat classification rather than autonomous vulnerability assessment and exploitation. Although Large Language Models (LLMs) have shown promise in general penetration testing and Capture-the-Flag (CTF) environments, their application to specific, dynamic IoT vulnerabilities remains largely unexplored. There is a critical need for adaptive systems capable of autonomously identifying, testing, and exploiting vulnerabilities across diverse IoT ecosystems.

Methodology

The authors propose VEXAIoT (Vulnerability EXploitation using AI Agents), an autonomous multi-agent framework designed to perform reconnaissance, vulnerability analysis, attack planning, and exploit execution in IoT environments. The framework utilizes LLM-based reasoning (specifically ChatGPT 5.1 thinking) and integrates with standard offensive security tools.

Architecture

The system employs a coordinated two-agent architecture:

1. Vulnerability Detection Agent:
   • Reconnaissance: Scans the target environment using nmap to identify open ports, exposed services, and active protocols.
   • Vulnerability Mapping: Queries searchsploit (Exploit Database) to map detected services and software versions to known CVEs and public exploit scripts.
   • Planning: Processes this data via an LLM prompt to analyze services, identify exploitable vulnerabilities, determine attack dependencies (e.g., credential requirements), and generate an ordered attack sequence.
2. Attack Execution Agent:
   • Tool Selection: Receives the attack plan and selects specific tools or scripts (e.g., bettercap, John the Ripper, custom exploit scripts) based on contextual vulnerability information.
   • Execution: Generates and executes bash commands to perform the attack on the target system.
   • Validation: Captures output and determines success or failure based on specific criteria (e.g., credential interception, service disruption, file modification).

Workflow and Logic

The framework operates autonomously once initiated. The Detection Agent orchestrates the workflow, calling the Execution Agent as a subprocess.

• Dependency Handling: The system manages attack dependencies; for instance, attacks requiring credentials wait for the successful completion of credential-gathering attacks (like MitM or password cracking) before proceeding.
• Retry Mechanism: If an attack fails, the Detection Agent analyzes failure messages (e.g., syntax errors, model refusals) and instructs the Execution Agent to retry with a modified strategy.
• Parallel Execution: The framework supports parallel execution of non-conflicting attacks to reduce wall-clock time, though token usage remains additive.
• Prompt Engineering: The system uses role-based prompts that constrain the LLM to the isolated testbed environment, available tools, and user-defined objectives. Functional descriptions of tools are used to reduce LLM refusal behavior while maintaining safety within the controlled environment.

Key Contributions

The paper outlines five primary contributions:

1. Framework Design: A multi-agent framework for autonomous IoT vulnerability assessment and exploitation using LLM reasoning and offensive security tools.
2. Vulnerability Detection Agent: An agent capable of performing reconnaissance, identifying exposed services/protocols, and analyzing known vulnerabilities using nmap and searchsploit.
3. Attack Execution Agent: An agent capable of selecting and executing attack-specific tools and scripts based on contextual vulnerability information and attack dependencies.
4. Reasoning Workflows: Designed prompt structures and workflows enabling coordinated attack planning, adaptive execution, and retry handling in response to failures or environmental feedback.
5. Empirical Evaluation: A comprehensive evaluation in IoTGoat and Metasploitable2 environments across multiple attack scenarios mapped to OWASP IoT vulnerabilities, demonstrating autonomous exploitation capabilities.

Experimental Results

The framework was evaluated in two controlled environments: IoTGoat (an intentionally vulnerable IoT firmware platform) and Metasploitable2 (a legacy vulnerable Linux system used as an IoT surrogate).

Performance Metrics

• Overall Success Rate: Across 260 total attack executions (200 in IoTGoat, 60 in Metasploitable2), VEXAIoT achieved a 95.0% overall success rate.
  • IoTGoat: 94.5% success rate (189/200 trials). Seven of the ten attack scenarios achieved 100% success (including XSS, Developer Backdoor, Update Attack, Database PII, Log Erase, and RCE).
  • Metasploitable2: 96.7% success rate (58/60 trials).
• Execution Time: Most attacks were completed in under two minutes. The average execution time for the full suite of 10 IoTGoat attacks was approximately 8 minutes and 31 seconds when run sequentially, but reduced to 3 minutes and 50 seconds using dependency-aware parallel execution.
• Token Usage: Token usage varied based on attack complexity. Simple attacks used ~500–700 tokens, while complex attacks involving file parsing (e.g., Database PII, Log Erase) used up to ~1,480 tokens. Parallel execution did not significantly reduce total token costs, as each attack still required a separate agent invocation.

Failure Analysis

The primary causes of failure were:

1. Model Refusals: The LLM declined to generate specific attack instructions (5 occurrences).
2. Persistent Syntax Errors: Generated commands contained invalid or incomplete parameters that were not corrected during retries (5 occurrences).
3. Hallucinations: The model generated incorrect information (1 occurrence).
   Failures were most common in attacks requiring precise command construction or service-specific behavior, such as MiniUPnP backdoor and DNS DoS attacks.

Significance and Claims

The paper claims that VEXAIoT demonstrates the feasibility of LLM-driven agents for automating security testing workflows in isolated IoT and IoT-adjacent environments. The results suggest that such agents can effectively adapt to multiple vulnerable systems, perform reconnaissance, and execute exploits mapped to OWASP IoT Top 10 vulnerabilities with high success rates and low token overhead.

The authors emphasize that while the system shows potential for automating offensive security workflows, reliable autonomous exploitation currently requires stronger command validation, safety controls, and error recovery mechanisms. The work is presented as a step toward adaptive systems that can autonomously identify and test vulnerabilities, contrasting with existing rule-based or manual approaches. The paper concludes by noting that future work will focus on schema-constrained command generation, retrieval-augmented reasoning, and the development of defensive agents to mitigate vulnerabilities discovered by adversarial agents.