PENTESTLLMAGENT: A Task Dependency Graph Planning-Based Multi-Agent Framework for Automated Penetration Testing

1 Introduction

The global cybersecurity landscape is facing a continuously expanding attack surface: the digitalization of critical infrastructure, cloud services, and network applications has accelerated system interconnection and increased exposure at scale [World Economic Forum, 2025]. In 2025 alone, the National Vulnerability Database's CVE yearly data feed contains 41,179 CVE records [National Institute of Standards and Technology, 2026], further highlighting the urgent need for scalable vulnerability identification and validation.

∗Corresponding author.

Penetration testing assesses system security by simulating attacker behaviors and validating exploitability and impact, providing critical evidence to support remediation prioritization. However, in real-world industrial workflows, penetration testing still heavily relies on skilled security experts performing manual execution: the process is time-consuming, costly, and difficult to scale linearly with the growth of exposed assets and disclosed vulnerabilities. Therefore, building fully autonomous and scalable penetration testing systems has become an important research direction.

In recent years, large language models (LLMs) have demonstrated strong capabilities in code understanding and generation as well as multi-step reasoning [Ferrag et al., 2025; Cheng et al., 2025], sparking broad interest in applying them to penetration testing. Prior work such as HackingBuddyGPT [Happe and Cito, 2023], PentestGPT [Deng et al., 2024], zerodayagent [Zhu et al., 2026], onedayagent [Fang et al., 2024], Autoattacker [Xu et al., 2024], AutoPT [Wu et al., 2025],and PentestAgent [Shen et al., 2025] has explored LLM-assisted penetration testing workflows and achieved promising progress [Happe and Cito, 2025]. Nevertheless, existing LLM-based penetration testing frameworks still exhibit clear limitations in automation and applicability: many approaches rely on human guidance for task planning and failure recovery [Happe and Cito, 2023; Deng et al., 2024]; some systems focus on specific attack domains or single-stage capabilities [Happe and Cito, 2023; Wu et al., 2025; Kimminich, 2024; Fang et al., 2024; Xu et al., 2024]; and a large portion of evaluations are mainly conducted in capture-the-flag (CTF) environments [Shao et al., 2024]. In contrast, realistic penetration testing often requires cross-domain, long-horizon attack chains, so achieving fully autonomous end-to-end (IP-to-Root) capability remains unsolved.

To systematically reveal the key bottlenecks in fully autonomous IP-to-Root penetration testing, we evaluate 10 mainstream LLMs on AUTOPENTEST-BENCH. AUTOPENTEST-BENCH is a realistic end-to-end benchmark that contains 13 publicly available and reproducible realworld target environments from VulnHub, and decomposes each task into 93 verifiable subtasks, covering the full attack pipeline from reconnaissance to exploitation and privilege escalation.

Our results show that end-to-end success rate and runtime

Note: SCR denotes Sub-task Completion Rate, which enables fine-grained diagnosis of failure points in autonomous attack pipelines.

stability are mainly constrained by three challenges:

• Rigid Strategy: the agent tends to follow a fixed linear workflow and struggles to adjust strategies dynamically based on environmental feedback; when exploitation fails, it lacks effective backtracking and switching to alternative paths, and can become trapped in the current execution branch.
• Contextual Forgetting: long-horizon execution under a limited context window, together with attention dilution caused by verbose tool outputs, leads to early critical evidence being forgotten in later stages, which degrades subsequent decision making and execution.
• Command Generation Hallucination: the agent may generate commands with syntax errors, invalid parameters, or executability issues; this is especially disruptive in exploitation scenarios involving complex commandline interfaces or multi-stage interactive tools, where such errors can break the entire workflow.

To address these challenges, we propose PENTESTLLMAGENT and design three corresponding core components:

• Task Dependency Graph (TDG) mitigates Rigid Strategy through dynamic planning, priority evaluation, and backtracking;
• Hierarchical Multi-Agent Architecture (HMA) mitigates Contextual Forgetting by decoupling the ultra-long context into a global orchestration context and execution contexts for multiple domain experts, and enabling interagent communication via function-calling-based structured tool invocation, tool-output filtering, and semantic compression;
• Executable Knowledge-Guided Command Generation (EKG-CG) reduces Command Generation Hallucination and improves execution stability by anchoring key actions in a pre-validated executable knowledge base and retrieving and invoking environment-compatible executable commands.

We summarize the main contributions of this paper as follows:

• FrameworkWe propose PENTESTLLMAGENT, a fully autonomous end-to-end penetration testing framework designed for realistic IP-to-Root attack scenarios.
• Benchmark We construct AUTOPENTEST-BENCH, a realistic end-to-end benchmark with 13 reproducible real-world target environments and 93 fine-grained subtasks, covering the full attack pipeline.
• Exploratory Study We conduct an exploratory study on fully autonomous IP-to-Root penetration testing, systematically evaluating the end-to-end capabilities and failure patterns of 10 mainstream LLMs on AUTOPENTEST-BENCH. Through quantitative analysis of interaction logs, we identify three core bottlenecks that limit success rate and runtime stability: Rigid Strategy, Contextual Forgetting, and Command Generation Hallucination.
• Methodology We introduce three core methods targeting the key challenges revealed by our exploratory study: TDG mitigates Rigid Strategy via dynamic planning and backtracking; HMA mitigates Contextual Forgetting via tool-output filtering and semantic compression; and EKG-CG reduces Command Generation Hallucination by retrieving and invoking pre-validated executable knowledge.
• Evaluation On the end-to-end benchmark, PENTESTLLMAGENT improves success rate by 31 percentage points over PENTESTGPT; on web vulnerability exploitation tasks, it improves by 60 percentage points over AUTOPT; and on privilege escalation tasks, it improves by 23 percentage points over HACKINGBUDDYGPT. Moreover, the average end-to-end execution time is 10.9 minutes, with an average cost of 69.6K tokens per target.

2 Penetration Testing Benchmark

To evaluate fully autonomous end-to-end penetration testing agents in realistic environments, we construct AUTOPENTEST-BENCH, covering the complete workflow from initial IP discovery to root access. As summarized in Table 1, existing benchmarks are limited for evaluating end-to-end autonomy: (1) many focus on a single stage;(2) coarse-grained metrics cannot localize failure modes. We build AUTOPENTEST-BENCH with 13 VulnHub targets and 93 verifiable subtasks: (1) Task selection: we select 13 publicly available, reproducible vulnerable virtual machines with documented end-to-end attack paths, covering diverse vulnerability types and realistic attack scenarios, resulting in 14 vulnerability categories, 27 CWE classes, and 71 concrete vulnerability instances; (2) Task decomposition: we split each target into atomic, machine-verifiable subtasks aligned with the phase framework of NIST SP 800-115 [Scarfone et al., 2008], and map each subtask to corresponding CWE identifiers for standardized statistics and comparative evaluation.

Note: SR: Success Rate; SCR: Sub-task Completion Rate. All values are raw experimental counts or percentages over 13 target environments.

3 Exploratory Study

This section evaluates the performance of LLMs in fully autonomous penetration testing. We assess mainstream models under zero human intervention and systematically analyze failure logs to summarize the key technical challenges that lead to task failures.

3.1 Evaluation Setup

We build an agent based on function calling [OpenAI, 2025], which connects an LLM to a Kali Linux terminal for command execution. We evaluate 10 mainstream LLMs with context windows ranging from 8K to 1M tokens. Experiments are conducted on AUTOPENTEST-BENCH. The task objective is to obtain root privileges on the target IP.

3.2 Challenges Analysis

Based on 130 interaction logs, we perform attribution-based categorization of failed trials to analyze the limitations of LLMs in fully autonomous penetration testing. The results indicate four common failure patterns, corresponding to the four metrics reported in Table 2:Wrong Command, Memory Loss, Planning Loop, and Command Deadlock. Further combined with qualitative analysis of the interaction traces, we summarize these phenomena into three core challenges:(1) Rigid strategy: the agent tends to follow a fixed linear execution flow and fails to adapt its attack strategy to environmental feedback; when an exploitation attempt fails, it often cannot effectively backtrack or switch to alternative paths, repeatedly consuming steps in the current execution branch.(2) Contextual forgetting: during long-horizon execution under finite context windows, together with attention dispersion caused by verbose tool outputs, the agent forgets earlier critical evidence in later stages.(3) Command generation hallucinations: the agent may produce commands with syntax errors, invalid parameters, or executability issues, interrupting the workflow; this issue is particularly pronounced for tools with complex command-line interfaces or multi-step interactions.

4 Methodology

4.1 Overview

PENTESTLLMAGENT is a fully autonomous framework for realistic end-to-end penetration testing in real-world environments (Figure 1). As an agentic LLM system [Plaat et al., 2025], the framework comprises three tightly coupled components, each targeting one core challenge:(1) TDG mitigates Rigid Strategy via dynamic planning, priority evaluation, and backtracking;(2) HMA mitigates Contextual Forgetting via tool-output filtering and semantic compression;(3) EKG-CG reduces Command Generation Hallucination by retrieving and invoking pre-validated executable commands compatible with the target environment.

4.2 Task Dependency Graph

To address Rigid Strategy in fully autonomous, end-to-end penetration testing, PENTESTLLMAGENT equips the Task Orchestration Agent with a TDG, which explicitly represents task dependencies and enables the agent to adapt subsequent actions based on execution feedback. Under the TDG mechanism, the agent maintains a structured global state (G (k) , I (k) ), so that in each round it can: (i) identify feasible next steps, (ii) perform priority evaluation based on the current evidence, and (iii) update the plan and adjust the attack path using execution feedback.

TDG definition and formalization. At scheduling round k, the TDG is defined as a directed acyclic graph: G (k) = (V (k) , E (k) ), where V (k) is the set of task nodes, and E (k) encodes dependency constraints induced by logical ordering or information dependencies. Each node v ∈ V (k) corresponds to an atomic executable task:v = (dv, sv, Av), where dv denotes the task type (service/stage), sv contains target-specific parameters (e.g., IP, port, service fingerprint, credentials), and Av specifies which tool or Domain-Expert Agent executes the task. Each node maintains a discrete status, such as Pending, Executing, Success, Failed, or Invalid, which governs whether the node can be scheduled and whether its downstream branch should be skipped after failures.

The system maintains a global observation state I (k) to aggregate key information obtained from tool/agent feedback in each round (e.g., open ports, service fingerprints, usable credentials, current privilege level, and reachable endpoints). We express its accumulation across rounds as:

where Findingv denotes the key information extracted and retained after executing node v.

TDG initialization. At initialization (k = 0), the orchestrator performs basic information collection (e.g., port scanning, service fingerprinting, and default script probing) to form:

Based on I (0) , the system instantiates service-related task nodes V (0) and constructs dependency relations E (0) to enforce the basic execution order.

Priority evaluation. At each round k, the orchestrator first screens feasible candidate nodes: C (k) = {v ∈ V (k) | State(v) = Pending ∧ Pre(v) ⊆ I (k) }, where Pre(v) denotes the prerequisites for executing v, jointly determined by TDG dependencies and task-specific preconditions. This filtering step ensures that only tasks whose required information has already been observed can be scheduled.

For each candidate node v ∈ C (k) , the orchestrator constructs an evaluation context X (k) v = (dv, sv, I (k) ,Kv), where dv and sv describe the task type and target-specific parameters, I (k) provides the current global observation state, and Kv denotes the executable knowledge associated with the task. We instantiate the priority function fprio as a lexicographically ordered priority tuple:

where Sstate, Sevi, and Skg correspond to state-driven, evidence-driven, and knowledge-assisted priority signals, respectively, and Sretry penalizes nodes that have repeatedly failed in previous attempts. Candidate nodes are ranked in lexicographic order, so state-enabled actions are preferred over evidence-supported actions, and evidence-supported actions are preferred over speculative knowledge-assisted attempts.

Specifically, Sstate(v) measures whether the task is directly enabled by newly obtained attack-state information in I (k) , such as usable credentials, a valid session, an obtained shell, or an upgraded privilege level. For example, after credentials are discovered, login and credential-validation tasks are assigned higher state priority than unrelated enumeration tasks. Sevi(v) measures whether the task is supported by explicit observations from tool outputs, such as open ports, service banners, script results, directory discovery outputs, or vulnerability indicators. For instance, if nmap -sC indicates that ftp anonymous is enabled, FTP login and file-enumeration nodes receive higher evidence priority. Skg(v) is computed from EKG-CG retrieval and verification results, considering semantic retrieval similarity, service/version compatibility, exploit precondition satisfaction, and vulnerability severity when available. Candidates that satisfy service-type and version-range constraints are prioritized, whereas candidates that only match semantically but fail compatibility checks are down-ranked or removed.

The next node is selected as v∗ = argmaxv∈C(k) p(k) v , where the maximization is performed according to the lexicographic order of the priority tuple.

Execution feedback and graph update. After executing node v∗ , the system receives standardized feedback r(k) v∗ = {Status, Finding}, and merges Finding into I (k+1) . The TDG is then updated based on new information: if new leads are discovered, the system adds corresponding task nodes and dependency relations; if a path is confirmed infeasible, downstream nodes are marked as Invalid to avoid wasting further attempts. When a node execution fails, the system retries up to a limited number of three times by adjusting parameters/commands according to error messages; if it still fails, the node is marked as Failed and the orchestrator re-runs priority evaluation to continue from other, more promising branches.

4.3 Hierarchical Multi-Agent Architecture

To mitigate Contextual Forgetting in long-horizon, end-toend penetration testing, we design a HMA that decouples context into global orchestration and Domain-Expert execution [Tran et al., 2025]. The key idea is to alleviate the distraction of the Task Orchestration Agent caused by verbose tool outputs via tool-output filtering, while allowing DomainExpert Agents to operate within task-local context and return semantically compressed key information to update the global observation state and support subsequent decisions.

Agent roles and responsibilities. HMA defines Task Orchestration Agent and Domain-Expert Agents with explicitly separated responsibilities.The Task Orchestration Agent acts as the global decision center. It maintains the global observation state I (k) and the TDG G (k) , selects the next node v∗ based on TDG, and dispatches it to the corresponding Domain-Expert Agent.Upon receiving a task, each DomainExpert Agent follows its domain workflow, invokes tools via a function-call interface, and performs dynamic planning based on tool feedback until the node is resolved or deemed failed. This role separation mirrors real-world penetration testing teams: a coordinator focuses on global strategy, while specialists handle local execution details and report task completion outcomes.

Tool-output filtering. We encapsulate penetration testing tools through OpenAI's function call mechanism, unifying common probing and attack actions into a set of function interfaces F = {f1, f2, . . . , fn}, where each function fi corresponds to a specific tool invocation. Instead of writing raw tool outputs directly into the model context, we design a tool-specific output filtering function Φ(·) to remove repetitive content and verbose noise while preserving key information useful for the current task: Cleanout = Φ(Rawout), In this way, tool outputs that are irrelevant to decision making are pruned as much as possible, helping the model focus its attention on key information.

Semantic compression and feedback. The Task Orchestration Agent does not transmit the full global history to Domain-Expert Agents. Instead, based on the attributes of the dispatched node v∗ , it constructs a task-relevant context slice Cslice from the global observation state:

The dispatched content includes only the information necessary to execute the node, such as the IP, port, and other key information directly related to the task, and is delivered via function call, thereby avoiding consumption of the DomainExpert Agent's limited context budget by irrelevant information. After completing a sequence of tool calls, the DomainExpert Agent does not return raw logs or multiple fragments of Cleanout. Instead, it compresses the local execution process into a structured semantic summary:

We define Rsummary as a compact, schema-constrained message with two fields: Status ∈ {Success, Failed} and Finding, where Finding records the key information needed for subsequent planning. Upon receiving Rsummary, the Task Orchestration Agent merges Finding into I (k+1) and updates G (k+1) accordingly.

4.4 Executable Knowledge-Guided Command Generation

To address Command Generation Hallucination, we propose EKG-CG. EKG-CG enables the LLM to retrieve and invoke pre-built and pre-validated executable commands from a penetration-testing knowledge base [Sharma, 2025]. By grounding command execution in reproducible executable knowledge, EKG-CG effectively reduces command generation hallucinations.

Executable knowledge base construction. We construct an executable knowledge base by collecting exploitation scripts from Exploit-DB, GTFOBins, and GitHub, followed by manual curation and standardization. Formally, the knowledge base K consists of entries defined as 5-tuples: ki = (vi, si, di, ei, fi), where vi denotes a unique vulnerability identifier (e.g., a CVE ID), si specifies the affected service fingerprint and version range, di provides a natural-language vulnerability description, fi provides natural-language remediation/mitigation guidance, and ei is an executable command that encapsulates the complete exploitation logic and exposes a standardized command-line interface.

Our current knowledge base contains approximately 500 carefully curated executable commands, covering exploitation and privilege escalation techniques for services relevant to our experiments. To reduce environmental variance, all commands are standardized and pre-validated in the Kali Linux environment used in our experimental setup. A major challenge in automated exploitation is handling interactive exploits that require multiple rounds of user input, which can lead to incomplete execution flows or being stuck in interactive waiting states. To address this, we explicitly expose all required inputs as command-line arguments and use scripts/wrappers to complete the necessary interaction flow and produce results within a single invocation. This avoids interactive blocking, ensuring that the agent can execute reliably without human intervention and obtain feedback useful for subsequent decision making.

Vector retrieval and semantic matching. Given a query q derived from target fingerprints and exploitation intent (e.g., service name, version information, open ports, and attack goals), our objective is to retrieve entries ki = (vi, si, di, ei, fi) from K that are compatible with the target environment, and return the vulnerability information and executable commands (i.e., the matched entries and their ei) for subsequent automated invocation. We first organize the retrievable information of each entry into a text representation: ti = vi ∥ si ∥ di, We then use an embedding model to map the query and entries into the same vector space [Lewis et al., 2020], and perform approximate nearest-neighbor search to obtain a top-K candidate set:

This stage prioritizes recall, allowing semantically relevant candidates that may not fully satisfy version-range constraints or preconditions, thereby avoiding missed matches caused by overly aggressive early filtering.

Because si typically encodes key constraints such as service type and version range, relying solely on vector similarity may introduce candidates that "look relevant" but are inapplicable. We therefore perform fine-grained consistency checks over the candidate set: based on the service fingerprint and version information in q, we verify whether each candidate satisfies (i) service/platform type match, (ii) versionrange compatibility (when si provides version constraints), and (iii) consistency between the candidate's key preconditions and q. In implementation, we use the LLM to verify candidates in Ccand and output the set of matched vulnerability identifiers:

which yields the final matched set of entries:

When the verification output is unparsable or unstable, we fall back to rule-/string-based matching to maintain robustness.

5 Experiments

This section systematically evaluates the effectiveness and generality of PENTESTLLMAGENT. Following the style of prior agent-based penetration testing evaluations, we organize our study around three research questions:(1)RQ1 (Overall Performance): How does PENTESTLLMAGENT compare with representative open-source baselines? (2)RQ2 (Ablation Study): How do the three core components:TDG,HMA and EKG-CG contribute to performance, and how do they address the three challenges:Rigid Strategy, Contextual Forgetting, and Command Generation Hallucination? (3)RQ3 (Practicality and Efficiency): Is PENTESTLLMAGENT practical for realistic end-to-end scenarios in terms of effectiveness and resource efficiency?

5.1 Experimental Setup

We compare PENTESTLLMAGENT with three representative LLM-based penetration testing systems: PENTESTGPT, AUTOPT, and HACKINGBUDDYGPT. Since these baselines target different scopes, we adopt a stage-aligned and protocolconsistent evaluation strategy. Specifically, PENTESTGPT is compared on the end-to-end AUTOPENTEST-BENCH, where success is measured by root access and progress is measured by sub-task completion; AUTOPT is compared under its web-facing CVE exploitation protocol using the overall pass rate; and HACKINGBUDDYGPT is compared under its local privilege-escalation protocol using root/non-root success. In each case, PENTESTLLMAGENT is evaluated under the same benchmark protocol without modifying task definitions, success criteria, or metric definitions.

5.2 Overall Performance (RQ1)

We evaluate RQ1 on three stage-aligned benchmarks: the end-to-end AUTOPENTEST-BENCH vs PENTESTGPT, the web CVE exploitation benchmark vs AutoPT, and the privilege escalation benchmark vs HackingBuddyGPT. On the end-to-end AUTOPENTEST-BENCH, PENTESTLLMAGENT demonstrates substantially stronger capability than PENTESTGPT: with qwen-max, our framework achieves an SR of 77%, compared to 46% for PENTESTGPT(Table 3). Meanwhile, PENTESTLLMAGENT also maintains higher SCR, indicating that even without root access, it can more reliably advance key steps along the attack chain and produce more complete attack progress.On AutoPT's web exploitation benchmark, we achieve an overall pass rate of 95%, significantly outperforming AutoPT's reported 35% (Table 4). On the HackingBuddyGPT privilege escalation benchmark, we also observe consistent improvements: multiple model configurations reach 100% SR, and the overall results are generally higher than the 77% best reported SR in the original paper (Table 5).

Overall, PENTESTLLMAGENT consistently outperforms representative baseline systems across three benchmarks, and shows consistent performance gains across 10 different LLM configurations, answering RQ1: our framework achieves stronger overall effectiveness and better cross-stage generalization.

5.3 Ablation Study (RQ2)

To validate the contributions of the three core components, we conduct an ablation study on AUTOPENTEST-BENCH. Results across 10 models are summarized in Table 6. Removing TDG decreases average SR from 55.6% to 19.9% and increases average rounds from 59.5 to 82.2, indicating that TDG's dynamic planning, priority evaluation, and backtracking are critical to performance. Removing HMA degrades average SR to 27.1% and decreases average SCR from 76.5% to 53.4%, suggesting that tool-output filtering and semantic compression help mitigate contextual forgetting. Removing EKG-CG results in the most severe degradation: average SR further drops to 9.3% and average SCR decreases to 44.9%, showing that retrieving and invoking pre-validated executable commands is crucial for reducing command generation hallucinations and improving execution stability during exploitation and privilege escalation.

Overall, TDG, HMA, and EKG-CG contribute to endto-end performance by targeting Rigid Strategy, Contextual Forgetting, and Command Generation Hallucination, respectively; the consistent trends across 10 different LLM configurations indicate that the gains primarily stem from the framework design, answering RQ2: all three components are necessary for robust end-to-end performance.

5.4 Practicality and Efficiency Analysis (RQ3)

To assess the practicality of our framework in realistic endto-end settings, we select the best-performing configuration (qwen-max) and conduct IP-to-Root evaluations on 13 VulnHub targets, with results summarized in Table 3. PENTESTLLMAGENT achieves an end-to-end SR of 77% and an SCR of 88%, indicating that the framework can stably advance and complete the key steps of the IP-to-Root attack chain without human intervention. In terms of efficiency, an end-to-end run takes 10.9 minutes on average, with 36 interaction rounds and 69.6k tokens consumed, demonstrating manageable time and resource cost. We also observe consistent effectiveness and cost trends across 10 different LLM configurations, suggesting that the framework remains practical under lower-cost model settings and does not rely on a particular foundation model.

Note: SR = success rate; SCR = sub-task completion rate; ATC = average time cost, min; ATT = average token cost, k; ATN = average turn number. LLM1-LLM10 correspond to o3, Gemini-2.5, GPT-4o, GPT-4, Qwen-Max, GPT-3.5, DeepSeek-V3, Kimi-K2, Qwen3-32B, and Qwen3-14B. PT1-PT3 correspond to DeepSeek-V3, GPT-4o, and o3. Easy: T1-T5; Medium: T6-T9; Hard: T10-T13.

Note: SR = success rate; SCR = sub-task completion rate; Round = average interaction rounds. Full = HMA + TDG + EKG-CG; NO-HMA, NO-TDG, and NO-EKG-CG denote removing the corresponding module. Bold indicates the best value for each metric under each model. LLM1-LLM10 correspond to o3, Gemini-2.5, GPT-4o, GPT-4, Qwen-Max, GPT-3.5, DeepSeek-V3, Kimi-K2, Qwen3-32B, and Qwen3-14B.

Overall, PENTESTLLMAGENT achieves 77% end-to-end SR and 88% SCR in realistic IP-to-Root scenarios, with an average cost of 10.9 minutes, 36 interaction rounds, and 69.6k tokens per target. This answers RQ3 by demonstrating strong practicality in terms of both effectiveness and resource efficiency.

6 Conclusion

This paper presented PENTESTLLMAGENT, a fully autonomous framework for realistic IP-to-Root penetration testing. Built on AUTOPENTEST-BENCH, our study identifies three challenges: Rigid Strategy, Contextual Forgetting, and Command Generation Hallucination. By integrating TDG, HMA, and EKG-CG, PENTESTLLMAGENT achieves consistent gains across end-to-end, web exploitation, and privilege-escalation benchmarks.

Ethical Statement

This work studies automated penetration testing, which is dual-use, and is intended only for defensive security research and authorized testing. All experiments are conducted on the controlled targets in AutoPentest-Bench, and EKG-CG executes only pre-validated commands to reduce unsafe or unintended behaviors. We strongly discourage any use on real systems without explicit permission and recommend complying with applicable laws, organizational policies, and responsible disclosure practices.

Acknowledgements

This work was partially supported by the National Key R&D Program of China under Grant No. 2022YFB3103500, the National Natural Science Foundation of China under Grant Nos. 62441233, U22A2030, 62472166, and 62002106, and the Technology Projects of Hunan Province under Grant No. 2015TP1004.