On the Surprising Efficacy of LLMs for Penetration-Testing

Andreas Happe; J\"urgen Cito

REVIEW 3 major objections 5 minor 1 cited by

On the Surprising Efficacy of LLMs for Penetration-Testing

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLMs have sufficient hacking capability to break into real enterprise networks, but their results vary between runs, so reliability rather than capability is the field's central obstacle.

desk verdict A useful, honest survey of the first two years of LLM pentesting that overstates its case slightly: the central 'efficacy' thesis is explicitly speculative and rests on benchmark evidence the paper itself admits doesn't transfer to real-world impact. read the letter →

arxiv 2507.00829 v1 pith:QMTL5LRY submitted 2025-07-01 cs.CR

Andreas Happe , Jürgen Cito This is my paper · ORCID

classification cs.CR

keywords penetrationtestinglargelanguagemodelsoffensivesecurityvibe-hackingautonomousagentspatternmatchingdual-useAIsafety

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper examines the first two years of using large language models (LLMs) for penetration testing and argues that their effectiveness is not a fluke: professional penetration testing is substantially pattern-matching against a homogeneous enterprise technology landscape, and pattern-matching is precisely what LLMs are good at. It claims LLMs already have sufficient hacking capability to attack real systems—from Linux privilege escalation to web applications, multi-stage networks, and enterprise Active Directory environments—but that their results are inconsistent across runs. The paper separates the current landscape into interactive 'vibe-hacking,' which it considers already established in industry, and fully autonomous agents, which it sees as a near-term prospect. A sympathetic reader should care because the security industry faces a large workforce gap, and the same capability that could automate defensive testing is already being picked up by malicious actors, making reliability and safeguards the central open problems.

What carries the argument

The load-bearing mechanism is the claimed alignment between penetration testing and LLM pattern-matching: penetration testing, the practice of simulating attacks to find vulnerabilities before criminals do, is described as largely the recognition and application of known patterns, and LLMs are pattern-matching systems. The paper's second organizing device is its taxonomy of interactive 'vibe-hacking' (human-in-the-loop use of LLMs for information retrieval, exploit generation, and guided attacking) versus autonomous agents (prototypes using tool-calling, structured output, retrieval-augmented generation, high-level task graphs, and possibly multiple collaborating agents). This taxonomy does the work of explaining why present-day use already succeeds while fully autonomous deployment remains blocked by reliability, safety, and accountability problems.

What would settle it

A controlled experiment would run the same LLM agent on matched target sets: enterprise-like systems built on the common stack and deliberately novel systems with unusual protocols, custom code, or unfamiliar configurations. If success rates are similar on both, the pattern-matching explanation is falsified; a sharp drop on the novel targets supports it. A supporting check is a time-use study of practitioners measuring how much of their work is pattern recognition versus novel reasoning.

Watch

Extended reading notes

Core claim

The central claim is that LLMs have become a vanguard for automated penetration testing because the structure of the task matches their strengths. Penetration testers recognize known patterns—version banners, error messages, insecure configurations, attack templates from prior engagements and CTF exercises—and apply known exploits; enterprise networks are a semi-monoculture, with over 90% of the largest companies relying on the same identity-management stack. LLMs excel at pattern-matching, tolerate uncertainty by implicitly discarding parts of their text-based world model, and arrive pre-trained with enough public hacking knowledge that no security-specific retraining is needed. The reviewed prototypes demonstrate sufficient capability across all phases of an attack, including privilege escalation, website compromise, multi-stage network attacks, and assumed-breach attacks on enterprise networks, with operational costs that compare favorably to human testers. The paper's own conclusion is that capability is no longer the bottleneck; reliability is, because the same prototype finds different attack chains on repeated runs.

Load-bearing premise

The load-bearing premise is that professional penetration testing is substantially pattern-matching against a homogeneous enterprise technology landscape; if real engagements frequently require novel reasoning, scenario-specific creativity, or diverse non-standard targets, the paper's explanation of why LLMs work collapses.

Editorial extensions

If this is right

Interactive vibe-hacking with a human in the loop is already practical today and will keep spreading through industry, because off-the-shelf models contain the needed knowledge at low marginal cost.
Fully autonomous penetration-testing agents are a near-term prospect, but their run-to-run inconsistency means practical deployment will need repeated runs, self-correction, or multi-agent ensembles, all of which raise token and time costs.
The capability-reliability split reframes the research agenda: the pressing problems are consistency, safety guardrails, and accountability, not training security-specific models.
Because the same techniques serve both white-hat and black-hat users, LLM penetration testing is a dual-use capability that defenders cannot safely ignore without ceding the advantage to malicious actors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Not stated in the paper but testable: if the pattern-matching explanation is correct, the same LLM agent should succeed far more often on enterprise-like targets (Active Directory, common web frameworks) than on deliberately novel or obscure targets, and this gap could be measured directly.
Not stated in the paper but a plausible corollary: as enterprise technology stacks diversify away from the current mono-culture, the LLM efficacy advantage should shrink unless retrieval or tooling supplies the missing patterns.
Not stated in the paper but worth testing: running many cheap LLM trajectories and fusing the successful steps, rather than perfecting one agent, may be the fastest route to reliable autonomous pentesting, trading token cost for consistency.
Not stated in the paper but a strategic implication: data-sovereignty and privacy constraints on cloud LLM use will push sensitive penetration testing toward local or on-premise models, making the observed weakness of small models with complex multi-step attacks a central obstacle to solve.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This is a genuinely useful review of the 2023–2025 LLM-pentesting literature, and the authors are more honest than most. They clearly mark Section 4 as speculation, they flag the messy-benchmark problem in §6.6.2, and they include work from many independent groups, not just their own. The vibe-hacking vs. autonomous-agent taxonomy is a good organizing device, and the obstacle list (reliability, safety, cost, sovereignty, accountability) is comprehensive. If you want one paper to hand someone entering this area, this is it.

The soft spots are real but mostly acknowledged. The explanatory mechanism—pentesting is substantially pattern-matching against a homogeneous enterprise stack—rests on one interview study [34] and the authors' own 13 years of experience. That's evidence, but not proof, and the paper builds on it as if it were settled. The capability evidence is almost entirely CTF boxes, vulnerable VMs, and a lab Active Directory network. The stress-test concern about train/test overlap is on point: Gioacchini et al. found LLMs solve challenges only when similar tasks are well documented publicly, which is exactly memorization rather than generalization. The paper doesn't resolve this; it concedes in §6.6.2 that synthetic testbeds 'often do not measure real-world impact' and then asserts in §6.6.1 that LLMs have 'sufficient hacking capabilities.' That tension is the core of the matter, and it's left hanging.

The prose overshoots at times too: 'vanguard for automated penetration-testing' is a stretch. What the evidence actually shows is that LLMs can, with human oversight and structured scaffolding, solve known vulnerability classes faster and cheaper than before. That's valuable, but it's not the same as autonomous penetration testing replacing professionals.

Who should read it? Newcomers wanting a map of the field, and researchers looking for open problems. The review part is solid enough to survive referee scrutiny; the position part needs to be separated or softened. I'd send it to peer review—the authors should be asked to either provide a systematic search methodology or explicitly label the causal claims as hypotheses to be tested, and to address the benchmark-overlap confound head-on. As it stands, it's a good survey with an unproven thesis, and it should be read that way.

Referee Report

3 major / 5 minor

Summary. This paper is a review/position paper on the use of large language models (LLMs) for penetration testing over 2023–2025. It surveys academic prototypes (Happe, Deng, Fang, Shao, Xu, Gioacchini, Kong, Singer, and others) and industry adoption, then argues that LLMs are surprisingly effective for this task because (i) penetration testing relies substantially on pattern-matching against a homogeneous enterprise technology landscape, (ii) LLMs inherently cope with the uncertainty that arises during engagements, and (iii) off-the-shelf models are cost-effective. The paper categorizes current practice into interactive 'vibe-hacking' and emerging autonomous agents, and it discusses obstacles to adoption: model reliability, safety, costs, privacy, accountability, and ethics. It concludes with research directions and a call for societal decisions about the trade-offs.

Significance. The paper is timely and useful as a synthesis of a fast-moving area. Its strengths are explicit acknowledgment of the speculative status of its explanatory mechanism (Section 4), a broad coverage of academic and industrial evidence including dual-use concerns, and concrete references to the authors' own prototypes and to independent groups. It also explicitly flags several known limitations, such as the reliability gap (Section 6.6.1) and the limited external validity of benchmarks (Section 6.6.2). If the central thesis is accepted, the paper would provide a useful framing for future research on LLM-driven offensive security. However, the paper's main claims—that LLMs are 'surprisingly effective' and that penetration testing is 'substantially' pattern-matching—are supported largely by anecdote, the authors' own work, and lab/CTF benchmarks that the paper itself concedes may not transfer to real-world professional engagements. The contribution is therefore more of a well-informed position statement than a validated empirical or systematic review.

major comments (3)

[§3.1.2, §6.6.2] The paper asserts, in §3.1.3 and §6.6.1, that prototypes demonstrate 'sufficient hacking capabilities' for penetration testing, but the evidence comes almost entirely from CTF boxes, vulnerable VMs, and a lab Active Directory network. Section 6.6.2 explicitly concedes that synthetic testbeds 'often do not measure real-world impact' and that benchmark desiderata conflict with real-world messiness. This concession undercuts the leap from lab successes to the claim that LLMs are a 'vanguard for automated offensive security.' The authors should either (a) substantially temper the efficacy claim in light of their own caveat, or (b) provide a concrete argument or evidence for why these benchmarks nonetheless transfer to professional engagements.
[§4.1] The pattern-matching premise is structural to the paper's explanation but is not tested. It rests on one interview study [34] by the authors themselves, on the authors' professional experience, and on a single statistic about Active Directory ubiquity. The manuscript even opens Section 4 with 'we speculate,' yet later sections treat the pattern-matching account as established. The authors should clearly mark this as a hypothesis and specify what empirical evidence would confirm or refute it—for example, a systematic comparison of tasks across real-world pentest reports—or, alternatively, integrate the speculation more explicitly into the paper's framing as an open research question.
[§3.1.2, §4.1.3] The reported benchmark successes are confounded by training-data overlap. Section 3.1.2 reports that AutoPenBench solved challenges only when similar tasks were well documented in public walkthroughs, and Section 4.1.3 cites [28] for the proposition that LLMs solve tasks when training examples resemble those tasks. Together, these statements suggest that the observed prototype successes may reflect memorization or pattern reuse from public writeups rather than a generalizable capability to handle novel, heterogeneous penetration-testing scenarios. The paper should address this overlap explicitly; otherwise, the 'surprising efficacy' claim is overstated relative to the evidence presented.

minor comments (5)

[§6.5.2] Typo: 'empathizes' should be 'emphasizes.'
[§6 (intro), §7] 'adaption' should be 'adoption' in several places (e.g., 'prevent further adaption' and 'enable and ease adaption').
[§4.4] 'high-light' should be 'highlight.'
[§6.2.1] Typo: 'forbidden form being targeted' should be 'forbidden from being targeted.'
[§5.1] The sentence about CTF players using OpenAI custom GPTs is vague ('Anecdotally, CTF players use OpenAI's custom GPTs support to create LLMs trained with previous challenges'); consider clarifying the tool and the evidence.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a survey whose claims rest on external prototypes and an explicitly labeled speculation section, not on equations or self-referential reductions.

full rationale

This paper is a literature review and position argument, not a derivation chain with fitted parameters or first-principles predictions. The 'surprising efficacy' claim is supported by results from several independent research groups (Fang et al., Shao et al., Xu et al., Gioacchini et al., Kong et al., Singer et al.) as well as the authors' own prototypes; no quantity is fitted to a subset of data and then reported as a prediction. The main explanatory mechanism (Section 4.1, that penetration testing substantially resembles pattern matching) is explicitly flagged as speculation: 'In this section we speculate why LLMs have become a part of the vanguard for automated penetration-testing,' and the authors invite future empirical work. The self-citation [34] used for this premise is a peer-reviewed empirical interview study, not an unverified assertion equivalent to the conclusion. Section 6.6.2's caveat that synthetic benchmarks 'often do not measure real-world impact' is a genuine external-validity concern about the surveyed evidence, but it does not make the argument circular. No self-definitional, fitted-input, uniqueness-imported, or ansatz-smuggling pattern is present.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters because the paper reports no quantitative model. The central argument depends on domain assumptions about the nature of penetration testing and LLM capabilities.

assumptions (4)

domain assumption Professional penetration testing is substantially pattern-matching across a homogeneous target landscape.
Section 4.1 argues that pentesting resembles pattern-matching based on interviews and enterprise stack statistics; this is the foundation for the LLM-fit thesis.
domain assumption Large language models excel at pattern-matching.
Section 4.1.3, citing [71,86,90]; this is contested in the literature, and the paper acknowledges reasoning models are 'merely getting better at pattern-matching'.
domain assumption Pattern-matching inherently copes with uncertainty in dynamic environments.
Section 4.2.2 claims LLMs implicitly invalidate stale world-views during attacks; no direct empirical test is provided.
domain assumption Costs of off-the-shelf LLM inference are low enough to make LLM-based pentesting cost-effective.
Section 4.3.2 cites a single cost range from the authors' own prototype [37] to generalize about cost-effectiveness.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On the Surprising Efficacy of LLMs for Penetration-Testing." pith.science (2026). https://pith.science/paper/QMTL5LRY

@misc{pith2026250700829,
  author       = {Pith},
  title        = {Pith review of: On the Surprising Efficacy of LLMs for Penetration-Testing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QMTL5LRY}},
  note         = {Machine review of arXiv:2507.00829}
}

read the original abstract

This paper presents a critical examination of the surprising efficacy of Large Language Models (LLMs) in penetration testing. The paper thoroughly reviews the evolution of LLMs and their rapidly expanding capabilities which render them increasingly suitable for complex penetration testing operations. It systematically details the historical adoption of LLMs in both academic research and industry, showcasing their application across various offensive security tasks and covering broader phases of the cyber kill chain. Crucially, the analysis also extends to the observed adoption of LLMs by malicious actors, underscoring the inherent dual-use challenge of this technology within the security landscape. The unexpected effectiveness of LLMs in this context is elucidated by several key factors: the strong alignment between penetration testing's reliance on pattern-matching and LLMs' core strengths, their inherent capacity to manage uncertainty in dynamic environments, and cost-effective access to competent pre-trained models through LLM providers. The current landscape of LLM-aided penetration testing is categorized into interactive 'vibe-hacking' and the emergence of fully autonomous systems. The paper identifies and discusses significant obstacles impeding wider adoption and safe deployment. These include critical issues concerning model reliability and stability, paramount safety and security concerns, substantial monetary and ecological costs, implications for privacy and digital sovereignty, complex questions of accountability, and profound ethical dilemmas. This comprehensive review and analysis provides a foundation for discussion on future research directions and the development of robust safeguards at the intersection of AI and security.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

A Survey of LLM-Driven Penetration Testing: Taxonomy, Co-Evolution, and Open Challenges
cs.SE 2026-07 accept novelty 5.5 of 10

LLM pentest agents co-evolved through four bottleneck-driven phases into RLVR systems, while CTF platforms became dual evaluation/training infrastructure and three linked reliability gaps remain.

Reference graph

Works this paper leans on

122 extracted references · 35 canonical work pages · cited by 1 Pith paper

[34]

Understanding hackers’ work: An empirical study of offensive security practitioners

Andreas Happe and Jürgen Cito. Understanding hackers’ work: An empirical study of offensive security practitioners. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE ’23, page 1669–1680. ACM, November 2023. doi: 10.1145/3611643.3613900. URL http://dx.doi.org/10....

work page arXiv 2023
[28]

Autopenbench: Benchmarking generative agents for penetration testing, 2024

Luca Gioacchini, Marco Mellia, Idilio Drago, Alexander Delsanto, Giuseppe Siracusano, and Roberto Bifulco. Autopenbench: Benchmarking generative agents for penetration testing, 2024. URL https://arxiv.org/abs/2410.03225

arXiv 2024
[1]

Control-flow integrity principles, implementations, and applications

Martín Abadi, Mihai Budiu, Ulfar Erlingsson, and Jay Ligatti. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC) , 13(1):1–40, 2009

2009
[2]

O1 is less powerful than o1-preview due to the less time it spends on thinking (compute time)

Anonymous. O1 is less powerful than o1-preview due to the less time it spends on thinking (compute time). https://www.reddit.com/r/OpenAI/comments/ 1h7qtaf/o1_is_less_powerful_than_o1preview_due_to_the/, December 2024. Accessed: 2025-06-29

2024
[3]

Performance of o1 vs

Anonymous. Performance of o1 vs. o1-preview. https://community.openai. com/t/performance-o1-vs-o1-preview/1046831/1, December 2024. Accessed: 2025-06-29

work page arXiv 2024
[4]

Introducing the model context protocol

Anthropic. Introducing the model context protocol. https://www.anthropic. com/news/model-context-protocol, November 2024. Accessed: 2025-06-02

2024
[5]

Detecting and countering malicious uses of claude: March

Anthropic. Detecting and countering malicious uses of claude: March
[6]

deterministic

Berk Atil, Sarp Aykent, Alexa Chittams, Lisheng Fu, Rebecca J. Passonneau, Evan Radcliffe, Guru Rajan Rajagopal, Adam Sloan, Tomasz Tudrej, Ferhan Ture, Zhe Wu, Lixinyu Xu, and Breck Baldwin. Non-determinism of "deterministic" llm settings, 2025. URL https://arxiv.org/abs/2408.04667

arXiv 2025

Show all 122 references

[7]

Llms for in- telligent software testing: A comparative study

Mohamed Boukhlif, Nassim Kharmoum, and Mohamed Hanine. Llms for in- telligent software testing: A comparative study. In Proceedings of the 7th In- ternational Conference on Networking, Intelligent Systems and Security , NISS ’24, New York, NY, USA, 2024. Association for Comput...

2024
[8]

Ai angst

Tim Bray. Ai angst. https://www.tbray.org/ongoing/When/202x/2025/06/06/ My-AI-Angst, June 2025. Accessed: 2025-06-29. Andreas Happe and Jürgen Cito

2025
[9]

Generative ai at work

Erik Brynjolfsson, Danielle Li, and Lindsey Raymond. Generative ai at work. The Quarterly Journal of Economics , page qjae044, 2025

2025
[10]

On large language models in national security applications

William N Caballero and Phillip R Jenkins. On large language models in national security applications. Stat, 14(2):e70057, 2025

2025
[11]

Leveling up fuzzing: Finding more vulnerabilities with ai

Oliver Chang, Dongge Liu, and Jonathan Metzman. Leveling up fuzzing: Finding more vulnerabilities with ai. https://security.googleblog.com/2024/11/leveling- up-fuzzing-finding-more.html, November 2024. Accessed: 2025-06-19

2024
[12]

Llamafirewall: An open source guardrail system for building secure ai agents

Sahana Chennabasappa, Cyrus Nikolaidis, Daniel Song, David Molnar, Stephanie Ding, Shengye Wan, Spencer Whitman, Lauren Deason, Nicholas Doucette, Abraham Montilla, et al. Llamafirewall: An open source guardrail system for building secure ai agents. arXiv preprint arXiv:2505.0...

2025 arXiv
[13]

Feder Cooper, Aaron Gokaslan, Amy B

A. Feder Cooper, Aaron Gokaslan, Amy B. Cyphert, Christopher De Sa, Mark A. Lemley, Daniel E. Ho, and Percy Liang. Extracting memorized pieces of (copyrighted) books from open-weight language models, 2025. URL https: //arxiv.org/abs/2505.12546

2025 arXiv
[14]

Bias and unfairness in information retrieval systems: New challenges in the llm era

Sunhao Dai, Chen Xu, Shicheng Xu, Liang Pang, Zhenhua Dong, and Jun Xu. Bias and unfairness in information retrieval systems: New challenges in the llm era. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 6437–6447, 2024

2024
[15]

Defeating prompt injections by design

Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design. arXiv preprint arXiv:2503.18813, 2025

2025 arXiv
[16]

{PentestGPT}: Evaluating and harnessing large language models for automated penetration testing

Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. {PentestGPT}: Evaluating and harnessing large language models for automated penetration testing. In 33rd USENIX Security Symposium (USENIX Secur...

2024
[17]

Schumpeter’s creative destruction: A review of the evidence

Arthur M Diamond Jr. Schumpeter’s creative destruction: A review of the evidence. Journal of Private Enterprise , 22(1):120, 2006

2006
[18]

The explainability challenge of generative ai and llms

Lee Dittmar. The explainability challenge of generative ai and llms. https://www. oceg.org/the-explainability-challenge-of-generative-ai-and-llms/, November
[19]

The potential for jurisdictional challenges to ai or llm training datasets

Chris Draper and Nicky Gillibrand. The potential for jurisdictional challenges to ai or llm training datasets. In AI4AJ@ ICAIL, 2023

2023
[20]

Large language models in information security research: A january 2024 survey

Rohit Dube. Large language models in information security research: A january 2024 survey. ResearchGate preprint RG, 2(20107.26404), 2024

2024
[21]

Google’s approach for secure ai agents

Santiago (Sal) Díaz, Christoph Kern, and Kara Olive. Google’s approach for secure ai agents. Technical report, 2025

2025
[22]

Gpts are gpts: Labor market impact potential of llms

Tyna Eloundou, Sam Manning, Pamela Mishkin, and Daniel Rock. Gpts are gpts: Labor market impact potential of llms. Science, 384(6702):1306–1308, 2024

2024
[23]

Llm agents can autonomously exploit one-day vulnerabilities, 2024

Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. Llm agents can autonomously exploit one-day vulnerabilities, 2024. URL https://arxiv.org/abs/ 2404.08144

2024 arXiv
[24]

Llm agents can autonomously hack websites, 2024

Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Llm agents can autonomously hack websites, 2024. URL https://arxiv.org/abs/2402. 06664

2024
[25]

Teams of llm agents can exploit zero-day vulnerabilities, 2024

Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Teams of llm agents can exploit zero-day vulnerabilities, 2024. URL https://arxiv.org/ abs/2406.01637

2024 arXiv
[26]

Wormgpt: a large language model chatbot for criminals

Mohamed Fazil Mohamed Firdhous, Walid Elbreiki, Ibrahim Abdullahi, BH Su- dantha, and Rahmat Budiarto. Wormgpt: a large language model chatbot for criminals. In 2023 24th International Arab Conference on Information Technology (ACIT), pages 1–6. IEEE, 2023

2023
[27]

Who’s asking? user personas and the mechanics of latent misalignment

Asma Ghandeharioun, Ann Yuan, Marius Guerard, Emily Reif, Michael Lepori, and Lucas Dixon. Who’s asking? user personas and the mechanics of latent misalignment. Advances in Neural Information Processing Systems , 37:125967– 126003, 2024

2024
[29]

Project naptime: Evaluating offensive security capabilities of large language models

Sergei Glazunov and Mark Brand. Project naptime: Evaluating offensive security capabilities of large language models. https://googleprojectzero.blogspot.com/ 2024/06/project-naptime.html, June 2024. Accessed: 2025-06-19

2024
[30]

Adversarial misuse of generative ai

Google Threat Intelligence Group. Adversarial misuse of generative ai. https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse- generative-ai, January 2025. Accessed: 2025-06-19

2025
[31]

A survey on llm-as-a-judge

Jiawei Gu, Xuhui Jiang, Zhichao Shi, Hexiang Tan, Xuehao Zhai, Chengjin Xu, Wei Li, Yinghan Shen, Shengjie Ma, Honghao Liu, et al. A survey on llm-as-a-judge. arXiv preprint arXiv:2411.15594, 2024

2024 arXiv
[32]

How we built our multi-agent research system

Jeremy Hadfield, Barry Zhang, Kenneth Lien, Florian Scholz, Jerem Fox, and Daniel Ford. How we built our multi-agent research system. https://www. anthropic.com/engineering/built-multi-agent-research-system, June 2025. Ac- cessed: 2025-06-21

2025
[33]

Getting pwn’d by ai: Penetration testing with large language models

Andreas Happe and Jürgen Cito. Getting pwn’d by ai: Penetration testing with large language models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 2082–2086, 2023

2023
[35]

Benchmarking practices in llm-driven offensive security: Testbeds, metrics, and experiment design, 2025

Andreas Happe and Jürgen Cito. Benchmarking practices in llm-driven offensive security: Testbeds, metrics, and experiment design, 2025. URL https://arxiv.org/ abs/2504.10112

2025 arXiv
[36]

On the ethics of using llms for offensive security, 2025

Andreas Happe and Jürgen Cito. On the ethics of using llms for offensive security, 2025. URL https://arxiv.org/abs/2506.08693

2025 arXiv
[37]

Can llms hack enterprise networks? au- tonomous assumed breach penetration-testing active directory networks, 2025

Andreas Happe and Jürgen Cito. Can llms hack enterprise networks? au- tonomous assumed breach penetration-testing active directory networks, 2025. URL https://arxiv.org/abs/2502.04227

2025 arXiv
[38]

Llms as hackers: Autonomous linux privilege escalation attacks

Andreas Happe, Aaron Kaplan, and Juergen Cito. Llms as hackers: Autonomous linux privilege escalation attacks. arXiv preprint arXiv:2310.11409, 2024

2024
[39]

A comprehensive overview of large language models (llms) for cyber defences: Opportunities and directions, 2024

Mohammed Hassanin and Nour Moustafa. A comprehensive overview of large language models (llms) for cyber defences: Opportunities and directions, 2024. URL https://arxiv.org/abs/2405.14487

2024 arXiv
[40]

Does prompt formatting have any impact on llm performance?,

Jia He, Mukund Rungta, David Koleczek, Arshdeep Sekhon, Franklin X Wang, and Sadid Hasan. Does prompt formatting have any impact on llm performance?,
[41]

How i used o3 to find cve-2025-37899, a remote zeroday vulnerability in the linux kernel’s smb implementation

Sean Heelan. How i used o3 to find cve-2025-37899, a remote zeroday vulnerability in the linux kernel’s smb implementation. https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a- remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/, May 2025...

2025
[42]

Ai and the increase of productivity and labor inequality in latin america: Potential impact of large language models on latin american workforce

Oliver Azuara Herrera, Laura Ripani, and Eric Torres Ramirez. Ai and the increase of productivity and labor inequality in latin america: Potential impact of large language models on latin american workforce. 2024

2024
[43]

URL https://arxiv.org/abs/2411.10541

arXiv
[44]

Llama guard: Llm-based input-output safeguard for human-ai conversations

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023

2023 arXiv
[45]

Ethics and algorithms

Civic Innovations. Ethics and algorithms. https://civic.io/2022/12/14/ethics- and-algorithms/, December 2022. Accessed: 2025-06-02

2022
[46]

Uncertainty of thoughts: Uncertainty-aware planning enhances information seeking in llms

Zhiyuan Hu, Chumin Liu, Xidong Feng, Yilun Zhao, See-Kiong Ng, Anh Tuan Luu, Junxian He, Pang Wei W Koh, and Bryan Hooi. Uncertainty of thoughts: Uncertainty-aware planning enhances information seeking in llms. Advances in Neural Information Processing Systems , 37:24181–24215, 2024

2024
[47]

How hungry is ai? benchmarking energy, water, and carbon footprint of llm inference, 2025

Nidhal Jegham, Marwen Abdelatti, Lassad Elmoubarki, and Abdeltawab Hen- dawi. How hungry is ai? benchmarking energy, water, and carbon footprint of llm inference, 2025. URL https://arxiv.org/abs/2505.09598

2025
[48]

From llms to llm-based agents for software engineering: A survey of current, challenges and future, 2024

Haolin Jin, Linghan Huang, Haipeng Cai, Jun Yan, Bo Li, and Huaming Chen. From llms to llm-based agents for software engineering: A survey of current, challenges and future, 2024. URL https://arxiv.org/abs/2408.02479

2024 arXiv
[49]

2024 isc2 cybersecurity workforce study

ISC2. 2024 isc2 cybersecurity workforce study. https://www.isc2.org/Insights/ 2024/10/ISC2-2024-Cybersecurity-Workforce-Study, October 2024. Accessed: 2025-06-13

2024
[50]

Advances in llms with focus on reasoning, adaptability, efficiency and ethics

Muhammad Zaeem Khan, Saleha Jamshed, Sadia Ahmad, Aleesha Zainab, Kay- nat Khatib, Faria Bibi, Abdul Rehman, et al. Advances in llms with focus on reasoning, adaptability, efficiency and ethics. arXiv preprint arXiv:2506.12365, 2025

2025
[51]

A survey of llm-driven ai agent communication: Protocols, security risks, and defense countermeasures, 2025

Dezhang Kong, Shi Lin, Zhenhua Xu, Zhebo Wang, Minghao Li, Yufeng Li, Yilun Zhang, Zeyang Sha, Yuyuan Li, Changting Lin, Xun Wang, Xuan Liu, Muhammad Khurram Khan, Ningyu Zhang, Chaochao Chen, and Meng Han. A survey of llm-driven ai agent communication: Protocols, security ris...

2025
[52]

Generation, Detection, and Evaluation of Role-play based Jailbreak attacks in Large Language Models

Zachary D Johnson. Generation, Detection, and Evaluation of Role-play based Jailbreak attacks in Large Language Models . PhD thesis, Massachusetts Institute of Technology, 2024

2024
[53]

Your brain on chatgpt: Accumulation of cognitive debt when using an ai assistant for essay writing task, 2025

Nataliya Kosmyna, Eugene Hauptmann, Ye Tong Yuan, Jessica Situ, Xian-Hao Liao, Ashly Vivian Beresnitzky, Iris Braunstein, and Pattie Maes. Your brain on chatgpt: Accumulation of cognitive debt when using an ai assistant for essay writing task, 2025. URL https://arxiv.org/abs/2...

2025 arXiv
[54]

Revolutionizing talent: the path in 21st century workforce transformation

Elizabeth Koumpan1 and Lynda McOwen. Revolutionizing talent: the path in 21st century workforce transformation. Human Factors, Business Management and Society, 33(16):74, 2024

2024
[55]

Vulnbot: Autonomous penetration testing for a multi-agent collaborative frame- work

He Kong, Die Hu, Jingguo Ge, Liangxiong Li, Tong Li, and Bingzhen Wu. Vulnbot: Autonomous penetration testing for a multi-agent collaborative frame- work. arXiv preprint arXiv:2501.13411, 2025

2025 arXiv
[56]

Shade-arena: Evaluating sabotage and monitoring in llm agents

Jonathan Kutasov, Yuqi Sun, Paul Colognese, Teun van der Weij, Linda Petrini, Chen Bo Calvin Zhang, AI Scale, John Hughes, Xiang Deng, Henry Sleight, et al. Shade-arena: Evaluating sabotage and monitoring in llm agents. On the Surprising Efficacy of LLMs for Penetration-Testing
[57]

Llms get lost in multi-turn conversation

Philippe Laban, Hiroaki Hayashi, Yingbo Zhou, and Jennifer Neville. Llms get lost in multi-turn conversation. arXiv preprint arXiv:2505.06120, 2025

2025 arXiv
[58]

Swetha Krishnamoorthi and Jarad Carleton. Active directory holds the keys to your kingdom, but is it secure? https://www.frost.com/growth-opportunity- news/active-directory-holds-the-keys-to-your-kingdom-but-is-it-secure, March 2020. Accessed: 2025-06-02

2020
[59]

Jinhyuk Lee, Anthony Chen, Zhuyun Dai, Dheeru Dua, Devendra Singh Sachan, Michael Boratko, Yi Luan, Sébastien M. R. Arnold, Vincent Perot, Siddharth Dalmia, Hexiang Hu, Xudong Lin, Panupong Pasupat, Aida Amini, Jeremy R. Cole, Sebastian Riedel, Iftekhar Naim, Ming-Wei Chang, a...

2024 arXiv
[60]

I think i’m done thinking about genai for now

Glyph Lefkowitz. I think i’m done thinking about genai for now. https://blog. glyph.im/2025/06/i-think-im-done-thinking-about-genai-for-now.html, June

2025
[61]

Operating multi-client influ- ence networks across platforms

Ken Lebedev, Alex Moix, and Jacob Klein. Operating multi-client influ- ence networks across platforms. https://cdn.sanity.io/files/4zrzovbb/website/ 45bc6adf039848841ed9e47051fb1209d6bb2b26.pdf, April 2025. Accessed: 2025- 06-19

2025
[62]

Malla: Demystifying real-world large language model integrated malicious services

Zilong Lin, Jian Cui, Xiaojing Liao, and XiaoFeng Wang. Malla: Demystifying real-world large language model integrated malicious services. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 4693–4710, 2024

2024
[63]

Ai-powered fuzzing: Breaking the bug hunting barrier

Dongge Liu, Jonathan Metzman, and Oliver Chang. Ai-powered fuzzing: Breaking the bug hunting barrier. https://security.googleblog.com/2023/08/ai- powered-fuzzing-breaking-bug-hunting.html, August 2023. Accessed: 2025-06- 19

2023
[64]

Accessed: 2025-06-29

2025
[65]

When thinking fails: The pitfalls of reasoning for instruction-following in llms

Xiaomin Li, Zhou Yu, Zhiwei Zhang, Xupeng Chen, Ziji Zhang, Yingying Zhuang, Narayanan Sadagopan, and Anurag Beniwal. When thinking fails: The pitfalls of reasoning for instruction-following in llms. arXiv preprint arXiv:2505.11423, 2025

2025 arXiv
[66]

Troy, Stuart J

Aengus Lynch, Benjamin Wright, Caleb Larson, Kevin K. Troy, Stuart J. Ritchie, Sören Mindermann, Ethan Perez, and Evan Hubinger. Agentic mis- alignment: How llms could be an insider threat. Anthropic Research, 2025. https://www.anthropic.com/research/agentic-misalignment

2025
[67]

Llm dataset inference: Did you train on my dataset? Advances in Neural Information Pro- cessing Systems, 37:124069–124092, 2024

Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. Llm dataset inference: Did you train on my dataset? Advances in Neural Information Pro- cessing Systems, 37:124069–124092, 2024

2024
[68]

Llm cyber evaluations don’t capture real-world risk, 2025

Kamil˙e Lukoši¯ut˙e and Adam Swanda. Llm cyber evaluations don’t capture real-world risk, 2025. URL https://arxiv.org/abs/2502.00072

2025 arXiv
[69]

The dual-use security dilemma and the social construction of insecurity

Amir Lupovici. The dual-use security dilemma and the social construction of insecurity. Contemporary Security Policy , 42(3):257–285, 2021

2021
[70]

Llama prompt guard 2

Meta. Llama prompt guard 2. https://www.llama.com/docs/model-cards-and- prompt-formats/prompt-guard/, January 2025. Accessed: 2025-06-21

2025
[71]

Large language models as general pattern machines, 2023

Suvir Mirchandani, Fei Xia, Pete Florence, Brian Ichter, Danny Driess, Montser- rat Gonzalez Arenas, Kanishka Rao, Dorsa Sadigh, and Andy Zeng. Large language models as general pattern machines, 2023. URL https://arxiv.org/abs/ 2307.04721

2023 arXiv
[72]

Why using chatgpt is not bad for the environment - a cheat sheet

Andy Masley. Why using chatgpt is not bad for the environment - a cheat sheet. https://andymasley.substack.com/p/a-cheat-sheet-for-conversations- about, April 2025. Accessed: 2025-06-23

2025
[73]

Mavikumbure, Victor Cobilean, Chathurika S

Harindra S. Mavikumbure, Victor Cobilean, Chathurika S. Wickramasinghe, Devin Drake, and Milos Manic. Generative ai in cyber security of cyber physical systems: Benefits and threats. In 2024 16th International Conference on Human System Interaction (HSI), pages 1–8, 2024. doi:...

2024
[74]

Large language models in cybersecurity: State-of-the-art, 2024

Farzad Nourmohammadzadeh Motlagh, Mehrdad Hajizadeh, Mehryar Majd, Pejman Najafi, Feng Cheng, and Christoph Meinel. Large language models in cybersecurity: State-of-the-art, 2024. URL https://arxiv.org/abs/2402.00891

2024 arXiv
[75]

Influence and cyber operations: an up- date

Ben Nimmo and Michael Flossman. Influence and cyber operations: an up- date. https://cdn.openai.com/threat-intelligence-reports/influence-and-cyber- operations-an-update_October-2024.pdf, October 2024. Accessed: 2025-06-13

2024
[76]

The threat of offensive ai to organizations

Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang, Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, et al. The threat of offensive ai to organizations. Computers & Security, 124:103006, 2023

2023
[77]

Global ransomware damage costs predicted to exceed $275 billion by 2031

Steve Morgan. Global ransomware damage costs predicted to exceed $275 billion by 2031. https://cybersecurityventures.com/global-ransomware-damage-costs- predicted-to-reach-250-billion-usd-by-2031/, April 2025. Accessed: 2025-06-02

2025
[78]

Introducting chatgpt

OpenAI. Introducting chatgpt. https://openai.com/index/chatgpt/, November
[79]

Introducing openai o1

OpenAI. Introducing openai o1. https://openai.com/o1/, September 2024. Ac- cessed: 2025-06-02

2024
[80]

Disrupting malicious uses of ai: June 2025

Ben Nimmo, Albert Zhang, Sophia Farquhar, and Kimo Murphy, Max Bu- manglag. Disrupting malicious uses of ai: June 2025. https://openai.com/global- affairs/disrupting-malicious-uses-of-ai-june-2025/, June 2025. Accessed: 2025- 06-13

2025
[81]

Disrupting malicious uses of ai: February 2025

Ben Nimmo, Albert Zhang, Matthew Richard, and Nathaniel Hartley. Disrupting malicious uses of ai: February 2025. https://cdn.openai.com/threat-intelligence- reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf, February 2025. Accessed: 2025-06-18

2025
[82]

Proof or bluff? evaluating llms on 2025 usa math olympiad

Ivo Petrov, Jasper Dekoninck, Lyuben Baltadzhiev, Maria Drencheva, Kristian Minchev, Mislav Balunović, Nikola Jovanović, and Martin Vechev. Proof or bluff? evaluating llms on 2025 usa math olympiad. arXiv preprint arXiv:2503.21934, 2025

2025 arXiv
[83]

Cipher: Cyberse- curity intelligent penetration-testing helper for ethical researcher

Derry Pratama, Naufal Suryanto, Andro Aprila Adiputra, Thi-Thu-Huong Le, Ahmada Yusril Kadiptya, Muhammad Iqbal, and Howon Kim. Cipher: Cyberse- curity intelligent penetration-testing helper for ethical researcher. Sensors, 24 (21):6878, 2024

2024
[84]

My ai skeptic friends are all nuts

Thomas Ptacek. My ai skeptic friends are all nuts. https://fly.io/blog/youre-all- nuts/, June 2025. Accessed: 2025-06-29

2025
[85]

Disrupting malicious uses of ai by state-affiliated threat actors

OpenAI. Disrupting malicious uses of ai by state-affiliated threat actors. https://openai.com/index/disrupting-malicious-uses-of-ai-by-state- affiliated-threat-actors/, February 2024. Accessed: 2025-06-19

2024
[86]

Annual share of organizations affected by ransomware at- tacks worldwide from 2018 to 2023

Ani Petrosyan. Annual share of organizations affected by ransomware at- tacks worldwide from 2018 to 2023. https://www.statista.com/statistics/204457/ businesses-ransomware-attack-rate/, November 2024. Accessed: 2025-06-13

2018
[87]

Anderson, Edward W

Saskia Laura Schröer, Giovanni Apruzzese, Soheil Human, Pavel Laskov, Hyrum S. Anderson, Edward W. N. Bernroider, Aurore Fass, Ben Nassi, Vera Rim- mer, Fabio Roli, Samer Salam, Chi En Ashley Shen, Ali Sunyaev, Tim Wadhwa- Brown, Isabel Wagner, and Gang Wang. Sok: On the offen...

2025
[88]

An empirical eval- uation of llms for solving offensive security challenges, 2024

Minghao Shao, Boyuan Chen, Sofija Jancheska, Brendan Dolan-Gavitt, Sid- dharth Garg, Ramesh Karri, and Muhammad Shafique. An empirical eval- uation of llms for solving offensive security challenges, 2024. URL https: //arxiv.org/abs/2402.11814

2024 arXiv
[89]

Future of work with ai agents: Auditing automation and augmentation potential across the u.s

Yijia Shao, Humishka Zope, Yucheng Jiang, Jiaxin Pei, David Nguyen, Erik Brynjolfsson, and Diyi Yang. Future of work with ai agents: Auditing automation and augmentation potential across the u.s. workforce, 2025. URL https://arxiv. org/abs/2506.06576

2025
[90]

Resh, Yi Ming, Xinyao Xia, Michael Overton, Gul Nisa Gürbüz, and Brandon De Breuhl

William G. Resh, Yi Ming, Xinyao Xia, Michael Overton, Gul Nisa Gürbüz, and Brandon De Breuhl. Complementarity, augmentation, or substitutivity? the impact of generative artificial intelligence on the u.s. federal workforce, 2025. URL https://arxiv.org/abs/2503.09637

2025 arXiv
[91]

Llm-based design pattern detection,

Christian Schindler and Andreas Rausch. Llm-based design pattern detection,
[92]

URL https://arxiv.org/abs/2502.18458

arXiv
[93]

Announcing the agent2agent protocol (a2a)

Rao Surapaneni, Miku Jha, Michael Vakoc, and Todd Segal. Announcing the agent2agent protocol (a2a). https://developers.googleblog.com/en/a2a-a-new- era-of-agent-interoperability/, April 2025. Accessed: 2025-06-02

2025
[94]

Systematic biases in llm simulations of debates

Amir Taubenfeld, Yaniv Dover, Roi Reichart, and Ariel Goldstein. Systematic biases in llm simulations of debates. arXiv preprint arXiv:2402.04049, 2024

2024 arXiv
[95]

From naptime to big sleep: Using large language models to catch vulnerabilities in real-world code

Big Sleep Team. From naptime to big sleep: Using large language models to catch vulnerabilities in real-world code. https://googleprojectzero.blogspot.com/2024/ 10/from-naptime-to-big-sleep.html, November 2024. Accessed: 2025-06-19

2024
[96]

The illusion of thinking: Understanding the strengths and limitations of reasoning models via the lens of problem complexity

Parshin Shojaee, Iman Mirzadeh, Keivan Alizadeh, Maxwell Horton, Samy Bengio, and Mehrdad Farajtabar. The illusion of thinking: Understanding the strengths and limitations of reasoning models via the lens of problem complexity. arXiv preprint arXiv:2506.06941, 2025

2025 arXiv
[97]

On the feasibility of using llms to execute multistage network attacks

Brian Singer, Keane Lucas, Lakshmi Adiga, Meghna Jain, Lujo Bauer, and Vyas Sekar. On the feasibility of using llms to execute multistage network attacks. arXiv preprint arXiv:2501.16466, 2025

2025
[98]

Outside the closed world: On using machine learning for network intrusion detection

Robin Sommer and Vern Paxson. Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE symposium on security and privacy, pages 305–316. IEEE, 2010

2010
[99]

Rainbows End: A Novel With One Foot In The Future

Vernor Vinge. Rainbows End: A Novel With One Foot In The Future . Tor Books, 2007

2007
[100]

kelly is a warm person, joseph is a role model

Yixin Wan, George Pu, Jiao Sun, Aparna Garimella, Kai-Wei Chang, and Nanyun Peng. " kelly is a warm person, joseph is a role model": Gender biases in llm- generated reference letters. arXiv preprint arXiv:2310.09219, 2023

2023 arXiv
[101]

Prompt engineering in consistency and reliability with the evidence- based guideline for llms

Li Wang, Xi Chen, XiangWen Deng, Hao Wen, MingKe You, WeiZhi Liu, Qi Li, and Jian Li. Prompt engineering in consistency and reliability with the evidence- based guideline for llms. NPJ digital medicine, 7(1):41, 2024

2024
[102]

Can you choose an a.i

The New York Times. Can you choose an a.i. model that harms the planet less? https://www.nytimes.com/2025/06/19/climate/ai-emissions-chatbot- accuracy.html, June 2025. Accessed: 2025-06-21

2025
[103]

Llama: Open and efficient foundation language models

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

2023 arXiv
[104]

A new evolutionary law

Valen Van. A new evolutionary law. Evolutionary theory, 1:1, 1973

1973
[105]

Coding agents

Simon Willison. Coding agents. https://simonwillison.net/2025/Jun/18/coding- agents/, June 2025. Accessed: 2025-06-21. Andreas Happe and Jürgen Cito

2025
[106]

The lethal trifecta for ai agents: private data, untrusted content, and external communication

Simon Willison. The lethal trifecta for ai agents: private data, untrusted content, and external communication. https://simonwillison.net/2025/Jun/16/the-lethal- trifecta/, June 2025. Accessed: 2025-06-21

2025
[107]

Large language models for cyber security: A systematic literature review, 2024

Hanxiang Xu, Shenao Wang, Ningke Li, Kailong Wang, Yanjie Zhao, Kai Chen, Ting Yu, Yang Liu, and Haoyu Wang. Large language models for cyber security: A systematic literature review, 2024. URL https://arxiv.org/abs/2405.04760

2024
[108]

The large language model (llm) paradox: Job creation and loss in the age of advanced ai

Yifei Wang. The large language model (llm) paradox: Job creation and loss in the age of advanced ai. Authorea Preprints, 2023

2023
[109]

Chain-of-thought prompting elicits reasoning in large language models

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems , 35:24824–24837, 2022

2022
[110]

Whiterabbitneo

WhiteRabbitNeo. Whiterabbitneo. https://huggingface.co/WhiteRabbitNeo, February 2024. Accessed: 2025-06-02

2024
[111]

Airline held liable for its chatbot giving passenger bad advice - what this means for travellers

Maria Yagoda. Airline held liable for its chatbot giving passenger bad advice - what this means for travellers. https://www.bbc.com/travel/article/20240222- air-canada-chatbot-misinformation-what-travellers-should-know, February
[112]

Patil, Ion Stoica, and Joseph E

Fanjia Yan, Huanzhi Mao, Charlie Cheng-Jie Ji, Tianjun Zhang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. Berkeley function calling leaderboard. https://gorilla.cs.berkeley.edu/blogs/8_berkeley_function_calling_ leaderboard.html, 2024

2024
[113]

A survey on large language model (llm) security and privacy: The good, the bad, and the ugly

Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, 4(2):100211, 2024. ISSN 2667-2952. doi: https://doi.org/10.1016/j.hcc.2024.100211....

2024
[114]

Autoattacker: A large language model guided system to implement automatic cyber-attacks

Jiacen Xu, Jack W Stokes, Geoff McDonald, Xuesong Bai, David Marshall, Siyue Wang, Adith Swaminathan, and Zhou Li. Autoattacker: A large language model guided system to implement automatic cyber-attacks. arXiv preprint arXiv:2403.01038, 2024

2024 arXiv
[115]

Nuclear deployed: Analyzing catastrophic risks in decision-making of autonomous llm agents, 2025

Rongwu Xu, Xiaojian Li, Shuo Chen, and Wei Xu. Nuclear deployed: Analyzing catastrophic risks in decision-making of autonomous llm agents, 2025. URL https://arxiv.org/abs/2502.11355

2025 arXiv
[116]

From collision to exploitation: Unleashing use-after-free vulner- abilities in linux kernel

Wen Xu, Juanru Li, Junliang Shu, Wenbo Yang, Tianyi Xie, Yuanyuan Zhang, and Dawu Gu. From collision to exploitation: Unleashing use-after-free vulner- abilities in linux kernel. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , pages 4...

2015
[118]

Accessed: 2025-06-21

2025
[121]

Review of generative ai methods in cybersecurity, 2024

Yagmur Yigit, William J Buchanan, Madjid G Tehrani, and Leandros Maglaras. Review of generative ai methods in cybersecurity, 2024. URL https://arxiv.org/ abs/2403.08701

2024 arXiv
[122]

When llms meet cybersecurity: A systematic literature review, 2024

Jie Zhang, Haoyu Bu, Hui Wen, Yu Chen, Lun Li, and Hongsong Zhu. When llms meet cybersecurity: A systematic literature review, 2024. URL https: //arxiv.org/abs/2405.03644

2024 arXiv
[123]

Self-challenging language model agents

Yifei Zhou, Sergey Levine, Jason Weston, Xian Li, and Sainbayar Sukhbaatar. Self-challenging language model agents. arXiv preprint arXiv:2506.01716, 2025

2025 arXiv
[2022]

Accessed: 2025-06-02

2025
[2025]

Accessed: 2025-06-19

https://www.anthropic.com/news/detecting-and-countering-malicious- uses-of-claude-march-2025, April 2025. Accessed: 2025-06-19

2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [34]

Understanding hackers’ work: An empirical study of offensive security practitioners

Andreas Happe and Jürgen Cito. Understanding hackers’ work: An empirical study of offensive security practitioners. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE ’23, page 1669–1680. ACM, November 2023. doi: 10.1145/3611643.3613900. URL http://dx.doi.org/10....

work page arXiv 2023

[2] [28]

Autopenbench: Benchmarking generative agents for penetration testing, 2024

Luca Gioacchini, Marco Mellia, Idilio Drago, Alexander Delsanto, Giuseppe Siracusano, and Roberto Bifulco. Autopenbench: Benchmarking generative agents for penetration testing, 2024. URL https://arxiv.org/abs/2410.03225

arXiv 2024

[3] [1]

Control-flow integrity principles, implementations, and applications

Martín Abadi, Mihai Budiu, Ulfar Erlingsson, and Jay Ligatti. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC) , 13(1):1–40, 2009

2009

[4] [2]

O1 is less powerful than o1-preview due to the less time it spends on thinking (compute time)

Anonymous. O1 is less powerful than o1-preview due to the less time it spends on thinking (compute time). https://www.reddit.com/r/OpenAI/comments/ 1h7qtaf/o1_is_less_powerful_than_o1preview_due_to_the/, December 2024. Accessed: 2025-06-29

2024

[5] [3]

Performance of o1 vs

Anonymous. Performance of o1 vs. o1-preview. https://community.openai. com/t/performance-o1-vs-o1-preview/1046831/1, December 2024. Accessed: 2025-06-29

work page arXiv 2024

[6] [4]

Introducing the model context protocol

Anthropic. Introducing the model context protocol. https://www.anthropic. com/news/model-context-protocol, November 2024. Accessed: 2025-06-02

2024

[7] [5]

Detecting and countering malicious uses of claude: March

Anthropic. Detecting and countering malicious uses of claude: March

[8] [6]

deterministic

Berk Atil, Sarp Aykent, Alexa Chittams, Lisheng Fu, Rebecca J. Passonneau, Evan Radcliffe, Guru Rajan Rajagopal, Adam Sloan, Tomasz Tudrej, Ferhan Ture, Zhe Wu, Lixinyu Xu, and Breck Baldwin. Non-determinism of "deterministic" llm settings, 2025. URL https://arxiv.org/abs/2408.04667

arXiv 2025