mlsanityData to 7 Oct 2026

LLM Agents can Autonomously Exploit One-day Vulnerabilities

arXiv 2404.08144 ↗First posted 11 Apr 2024cs.CR cs.AIcited by 125

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

LLMs have becoming increasingly powerful, both in their benign and malicious uses. With the increase in capabilities, researchers have been increasingly interested in their ability to exploit cybersecurity vulnerabilities. In particular, recent work has conducted preliminary studies on the ability of LLM agents to autonomously hack websites. However, these studies are limited to simple vulnerabilities. In this work, we show that LLM agents can autonomously exploit one-day vulnerabilities in real-world systems. To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the CVE description. When given the CVE description, GPT-4 is capable of exploiting 87% of these vulnerabilities compared to 0% for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and Metasploit). Fortunately, our GPT-4 agent requires the CVE description for high performance: without the description, GPT-4 can exploit only 7% of the vulnerabilities. Our findings raise questions around the widespread deployment of highly capable LLM agents.

Key facts. Cited by 125 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 29 of its 53 references that are in the map. First posted on arXiv 11 Apr 2024.

Builds on

29 of 53 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 28

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  6. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  7. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  8. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  9. 2023Mistral 7Bcited by 3,065
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  11. 2022Emergent Abilities of Large Language Modelscited by 2,483
  12. 2024Mixtral of Expertscited by 1,785
16 more
  1. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  2. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  3. 2023ChemCrow: Augmenting large-language models with chemistry toolscited by 609
  4. 2023Are Emergent Abilities of Large Language Models a Mirage?cited by 515
  5. 2023Augmented Language Models: a Surveycited by 398
  6. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 284
  7. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  8. 2023OpenChat: Advancing Open-source Language Models with Mixed-Quality Datacited by 250
  9. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  10. 2023Removing RLHF Protections in GPT-4 via Fine-Tuningcited by 165
  11. 2023Emergent autonomous scientific research capabilities of large language modelscited by 127
  12. 2024Evaluating Frontier Models for Dangerous Capabilitiescited by 121
  13. 2018Automated Vulnerability Detection in Source Code Using Deep Representation Learningcited by 114
  14. 2023Getting pwn'd by AI: Penetration Testing with Large Language Modelscited by 82
  15. 2024TDAG: A Multi-Agent Framework based on Dynamic Task Decomposition and Agent Generationcited by 50
  16. 2022Will AI Make Cyber Swords or Shields: A few mathematical models of technological progresscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 26; 2025: 39; 2026: 60.

125 papers.

Sort:

By area:

  1. 2025Evaluation and Benchmarking of LLM Agents: A Surveycited by 145
  2. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 127
  3. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  4. 2024Teams of LLM Agents can Exploit Zero-Day Vulnerabilitiescited by 93
  5. 2025CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilitiescited by 90
  6. 2024From LLMs to LLM-based Agents for Software Engineering: A Survey of Current, Challenges and Futurecited by 85
  7. 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
  8. 2024CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Modelscited by 56
  9. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 44
  10. 2025Infrastructure for AI Agentscited by 40
  11. 2025VulnBot: Autonomous Penetration Testing for A Multi-Agent Collaborative Frameworkcited by 30
  12. 2026Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agentscited by 28
38 more
  1. 2025Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysiscited by 27
  2. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  3. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
  4. 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMscited by 22
  5. 2025Frontier AI's Impact on the Cybersecurity Landscapecited by 21
  6. 2024Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detectioncited by 18
  7. 2024On the Limitations of Compute Thresholds as a Governance Strategycited by 17
  8. 2025Estimating Worst-Case Frontier Risks of Open-Weight LLMscited by 17
  9. 2025A Survey on Agentic Security: Applications, Threats and Defensescited by 17
  10. 2024Defending Against Social Engineering Attacks in the Age of LLMscited by 15
  11. 2025Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testingcited by 14
  12. 2024SECURE: Benchmarking Large Language Models for Cybersecuritycited by 13
  13. 2025Personalized Attacks of Social Engineering in Multi-turn Conversations: LLM Agents for Simulation and Detectioncited by 13
  14. 2025Benchmarking Practices in LLM-driven Offensive Security: Testbeds, Metrics, and Experiment Designcited by 13
  15. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 12
  16. 2025OCCULT: Evaluating Large Language Models for Offensive Cyber Operation Capabilitiescited by 12
  17. 2024Towards Automated Penetration Testing: Introducing LLM Benchmark, Analysis, and Improvementscited by 11
  18. 2025FaultLine: Automated Proof-of-Vulnerability Generation Using LLM Agentscited by 11
  19. 2024Societal Adaptation to Advanced AIcited by 10
  20. 2025RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agentscited by 9
  21. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 9
  22. 2024VulScribeR: Exploring RAG-based Vulnerability Augmentation with LLMscited by 7
  23. 2025Dynamic Risk Assessments for Offensive Cybersecurity Agentscited by 7
  24. 2024A Jailbroken GenAI Model Can Cause Substantial Harm: GenAI-powered Applications are Vulnerable to PromptWarescited by 6
  25. 2024CIPHER: Cybersecurity Intelligent Penetration-testing Helper for Ethical Researchercited by 6
  26. 2025RedTeamLLM: an Agentic AI framework for offensive securitycited by 6
  27. 2026AgentRaft: Automated Detection of Data Over-Exposure in LLM Agentscited by 6
  28. 2024Co-Learning: Code Learning for Multi-Agent Reinforcement Collaborative Framework with Conversational Natural Language Interfacescited by 5
  29. 2024Applying Refusal-Vector Ablation to Llama 3.1 70B Agentscited by 5
  30. 2025Logic Meets Magic: LLMs Cracking Smart Contract Vulnerabilitiescited by 5
  31. 2026Autonomous Action Runtime Management(AARM):A System Specification for Securing AI-Driven Actions at Runtimecited by 5
  32. 2026Token Economics for LLM Agents: A Dual-View Study from Computing and Economicscited by 5
  33. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  34. 2024Declare and Justify: Explicit assumptions in AI evaluations are necessary for effective regulationcited by 4
  35. 2024What AI evaluations for preventing catastrophic risks can and cannot docited by 4
  36. 2025Mapping AI Benchmark Data to Quantitative Risk Estimates Through Expert Elicitationcited by 4
  37. 2025DefenderBench: A Toolkit for Evaluating Language Agents in Cybersecurity Environmentscited by 4
  38. 2025Improving LLM Agents with Reinforcement Learning on Cryptographic CTF Challengescited by 4

50 most cited of 125 All 125 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024LLM Agents can Autonomously Hack Websites
  2. 2026Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities
  3. 2025An Empirical Study on the Security Vulnerabilities of GPTs ↗
  4. 2026ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
  5. 2025When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents
  6. 2026ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
  7. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification
  8. 2026Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer