# APIOT: Autonomous Vulnerability Management Across Bare-Metal Industrial OT Networks

arXiv: https://arxiv.org/abs/2605.02346 · HTML: https://mlsanity.com/paper/2605.02346/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 45 references that are in the map.
- First posted on arXiv 4 May 2026.

## Builds on (most cited first, 17 of 17)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Self-Consistency Improves Chain of Thought Reasoning in Language Models](https://mlsanity.com/paper/2203.11171/) (2022)
- [Reflexion: Language Agents with Verbal Reinforcement Learning](https://mlsanity.com/paper/2303.11366/) (2023)
- [AgentBench: Evaluating LLMs as Agents](https://mlsanity.com/paper/2308.03688/) (2023)
- [AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents](https://mlsanity.com/paper/2503.18666/) (2025)
- [Security and Privacy Challenges of Large Language Models: A Survey](https://mlsanity.com/paper/2402.00888/) (2024)
- [LLM Agents can Autonomously Exploit One-day Vulnerabilities](https://mlsanity.com/paper/2404.08144/) (2024)
- [GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning](https://mlsanity.com/paper/2406.09187/) (2024)
- [AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks](https://mlsanity.com/paper/2403.01038/) (2024)
- [Getting pwn'd by AI: Penetration Testing with Large Language Models](https://mlsanity.com/paper/2308.00121/) (2023)
- [ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback](https://mlsanity.com/paper/2601.10156/) (2026)
- [Security Concerns for Large Language Models: A Survey](https://mlsanity.com/paper/2505.18889/) (2025)
- [LLMs as Hackers: Autonomous Linux Privilege Escalation Attacks](https://mlsanity.com/paper/2310.11409/) (2023)
- [Cybersecurity for Industrial Control Systems: A Survey](https://mlsanity.com/paper/2002.04124/) (2020)
- [P2IM: Scalable and Hardware-independent Firmware Testing via Automatic Peripheral Interface Modeling (extended version)](https://mlsanity.com/paper/1909.06472/) (2019)
- [Edge-Fog Cloud: A Distributed Cloud for Internet of Things Computations](https://mlsanity.com/paper/1702.06335/) (2017)
- [IoT-Flock: An Open-source Framework for IoT Traffic Generation](https://mlsanity.com/paper/2004.00844/) (2020)

## Abstract (arXiv)

Operational technology (OT) devices run safety-critical physical processes, yet their security testing remains manual and expert-intensive. Autonomous security agents could ease this burden, but bare-metal OT devices are difficult targets because they lack shells, filesystems, and named exploit abstractions, requiring operation through protocol fields and observable device state. We present APIOT (Autonomous Purple-teaming for Industrial OT), a large language model (LLM) agent framework that completes a discovery -> exploitation -> network-level mitigation -> verification workflow without human intervention. We evaluate APIOT in 360 runs on vulnerable firmware and simulators for Zephyr RTOS, spanning five LLMs, three topologies, two impairment levels, and prompt, tooling and two ablations. APIOT completed 90% of primary missions (63/70 across protocols and topologies) and 85% of 150 cross-model runs (128/150) - feasible across models, with substantial variation. Named exploit tools (e.g., a canned CoAP option-overflow) were faster, but protocol primitives (the agent builds the fields itself) produced more reusable mitigations that blocked unseen payload variants. Runtime oversight improved reliability: success rose from 27/30 to 29/30 with rule-based guards and 30/30 when a second LLM added advisory steering. To our knowledge, this is the first end-to-end autonomous attack-remediation demonstration on bare-metal industrial devices, establishing controlled feasibility - not zero-day discovery or production-OT transfer.