Practical Automation of Penetration Testing with Agentic AI

Practical Automation of Penetration Testing with Agentic AI

Speakers: Hiroaki Toyota, AI Technology Department Member, LAC Corporation

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=ue9oFtpESQY

Overview

In an era where cyber threats are constantly evolving and attack surfaces are rapidly expanding, the demand for more efficient and comprehensive penetration testing solutions is at an all-time high. This talk, delivered by Hiroaki Toyota, an AI Technology Department Member at LAC Corporation, delves into the transformative potential of agentic AI for automating penetration testing workflows. Toyota, an AI researcher with a background in machine learning and deep learning, presents a novel framework designed to autonomously conduct penetration tests by integrating advanced planning, security knowledge retrieval, tool usage, and step-by-step execution.

The core premise of this research is to address the significant challenges inherent in traditional penetration testing, which remains largely manual, expertise-dependent, and prone to inconsistencies. While general-purpose large language models (LLMs) like ChatGPT have shown promise, Toyota argues that specialized agentic AI systems offer distinct advantages in the complex and nuanced domain of cybersecurity. The presented framework aims to deliver a production-ready solution that covers the entire pentesting lifecycle, from adaptive planning and exploitation to final reporting, all while incorporating crucial safety and governance mechanisms. This work highlights a practical approach to leveraging AI to enhance the speed, consistency, and repeatability of penetration testing operations.

Background

▶ Watch: Introduction to agentic AI for penetration testing (0:00)

Penetration testing is a critical security practice involving authorized cyber attack simulations to identify and remediate vulnerabilities. This multi-phase process typically includes reconnaissance, scanning, vulnerability analysis, exploitation, post-exploitation activities, and comprehensive reporting. Each phase demands diverse skill sets and specialized tools, contributing to a workflow that is often characterized by its manual nature, trial-and-error approach, and the significant time investment required for consistent repeatability and detailed reporting. The ever-expanding attack surface further exacerbates these challenges, making the automation of penetration testing a compelling area of research.

The rapid evolution of large language models (LLMs) has spurred significant advancements in automated penetration testing. Early efforts, following the introduction of ChatGPT, focused on improving model performance and prompting techniques like chain-of-thought reasoning. This quickly evolved into more autonomous behaviors, emphasizing tool usage and agent-based workflows. Several specialized pentest-oriented systems emerged, each pushing the boundaries of what LLMs could achieve:

• Pentest GPT (August 2023): One of the earliest studies, it proposed a three-stage modular pipeline with a task tree structure for process tracking. However, it relied on GPT-3.5, suffered from a short context window requiring frequent summarization, and necessitated manual execution of CLI commands, limiting its ability to handle tasks requiring deeper expertise or external interaction.
• PenEval (July 2024): Represented a significant leap by introducing a fully automated command execution pipeline. It integrated GPT-4 with an LMM (Large Memory Module) to retrieve CVE and exploit knowledge, enabling the LLM to plan, execute commands, and collect results without human intervention. PenEval also featured a modular loop (planner, executor, summarizer) and a unique remediation module for synthesizing patches. Its primary limitation was its heavy reliance on predefined databases, potentially missing zero-days or environment-specific vulnerabilities.
• Pentest Agent (November 2024): Further evolved the concept by introducing a full multi-agent architecture. Unlike earlier LLM chains, Pentest Agent coordinated specialized agents (reconnaissance, planning, execution, online search) with specific responsibilities. It incorporated self-reflection-based reasoning and a two-layer RAG (Retrieval Augmented Generation) system for attack surface suggestions and exploit knowledge. Despite these advancements, it struggled with combining multiple vulnerabilities into complex exploit chains, highlighting the need for deeper contextual understanding and scenario planning.

Building upon these foundational works, Hiroaki Toyota's research group at LAC Corporation, in collaboration with Professor Takagi's laboratory at Meiji University, extended the PenEval framework. Their prior project aimed to automatically solve Hack The Box machines, such as "Right." The architecture leveraged GPT-4, a Qdrant vector database, RAG integrated with MITRE ATT&CK and Hacktoria, web search, and reasoning methods like ReAct and Self-Refine. This system successfully automated tasks including port scanning, server information gathering, subdomain enumeration, vulnerability discovery, exploit execution, SSH login, and privilege escalation. While it generated stable and appropriate commands, it encountered difficulties with sensitive data collection, particularly specifying correct directory paths—a known weakness for LLMs. The insights gained from this project became the cornerstone for the agentic AI-based penetration testing automation presented in this talk.

Key Findings

▶ Watch: Defining agentic AI and its pen-testing capabilities (12:00)

The central finding of this research is the successful development and evaluation of an agentic AI orchestration framework capable of automating significant portions of the penetration testing lifecycle. Agentic AI, as defined in the talk, refers to systems that can perform autonomous reasoning and actions to achieve high-level goals through self-directed planning, tool usage, execution, and self-correction. This differs from conventional AI agents by enabling collaborative multi-agent orchestration, dynamic adaptation, persistent shared memory, and enhanced explainability, allowing it to scale beyond single-agent capabilities.

The primary objectives of LAC's research were twofold:

1. To build a production-ready agentic AI orchestration covering the entire pentesting workflow, from adaptive planning and exploitation to final reporting, with a central governance agent ensuring all actions comply with scope and predefined rules.
2. To develop a modern multi-agent workflow architecture incorporating reasoning modules for both planning and on-demand retrieval, enabling scalable coordination across multiple AI agents.

The proposed architecture is built around a core pipeline comprising three main agents: the Planner, Executor, and Verifier. These are supported by two specialized agents: the Analyst, responsible for on-demand knowledge retrieval through agentic RAG, and the Guardian, which enforces safety and scope compliance. This entire system operates through an orchestration layer (powered by N8N) interacting with an execution layer (running on Kali Linux) and the target environment.

Key design principles underpinning this framework include:

• Schema-driven context management: All agent outputs are logged to a predefined JSON schema (referred to as "run state") to prevent free-form drift and maintain consistency. This schema is organized around a "past, now, future" timeline, aiding precise planning and disciplined progress tracking.
• Analyst Agent: This component is built on an agentic RAG framework, performing multi-hop reasoning across multiple attack sources like MITRE ATT&CK and Hacktoria. It continuously refines its output and can perform web searches to complement retrieved information, iteratively refining its conclusions until a complete answer is synthesized.
• Guardian Agent: An innovative lightweight layer for safety and governance. While still exploratory, its goal is to pre-screen every command against project-defined policies, preventing out-of-scope or destructive operations. It checks conditions such as allowed target, avoidance of destructive actions, and prevention of off-target exploitation. This agent aims to combine LLM-based judgment with rule-based filters for a robust safety layer.

Crucially, the speaker highlights N8N as a central tool for implementation. N8N, a powerful low-code automation platform, is praised for its self-hosted deployment capabilities (ensuring data control), visual workflow interface (aiding development, debugging, and explanation), and rapid evolution. It serves not just as an orchestrator but as an adaptive and fast experimental foundation for the agentic AI workflows.

Technical Deep Dive

▶ Watch: Transition to real-world penetration testing experiments (27:00)

The proposed agentic AI system follows a continuous, interactive workflow designed to mimic a human penetration tester's thought process. The baseline workflow consists of four major phases: Plan, Execute, Verify, and Report. Each phase involves continuous interaction among multiple agents. The process begins with initialization, preparing the context. The Planner then generates the first attack step, followed by the Executor producing the corresponding command. The Guardian agent rigorously checks this command for safety and scope compliance before it's dispatched to Kali Linux for execution. The Verifier evaluates the output from Kali Linux, and if necessary, provides feedback to the Planner to determine the next action, forming an interactive loop. Once all results are collected, the Reporter generates the final output, completing the workflow.

To evaluate this agentic workflow, experiments were conducted in two stages: CTF-style environments and real-world penetration testing scenarios.

CTF-Based Experiments (PenBench):

The initial evaluation leveraged PenBench, a benchmark specifically designed for generative AI agents in automated penetration testing. PenBench offers 33 task scenarios, an open-source setup, and ready-to-use vulnerable Docker environments. The evaluation focused on two primary KPIs: Success Rate (whether the agent completed the required exploitation flow) and Progress Rate (how far the agent advanced through predefined milestones). For practical relevance, the evaluation concentrated on web security tasks, excluding dictionary-based attacks or cryptographic challenges that are less common in typical real-world pentesting.

The results from running the agentic workflow on web security scenarios revealed several insights:

• Directory traversal proved to be the weakest area, primarily because the agent was not optimized for guess payload exploitation.
• SQL injection was handled surprisingly well, especially multi-step enumeration using tools like SQLMap.
• For Remote Code Execution (RCE) tasks, bottlenecks were identified in payload crafting and file upload exploitation, which remain challenging for LLMs without explicit guidance.

Overall, these CTF-style tests successfully validated the agent's ability to generate and execute commands correctly, completing meaningful attack chains end-to-end.

A crucial aspect of the workflow is its reporting capabilities. All intermediate findings and execution results are exchanged through a structured JSON schema. This allows the reporting agent to reliably convert these findings into an HTML draft. A separate "coding agent" then formats and refines this draft into a polished final report. The completed HTML is returned to an external system via a webhook, enabling seamless integration with dashboards or ticketing pipelines, significantly reducing the overhead of documentation.

Real-World Penetration Testing Experiments:

The most critical part of the evaluation involved real-world penetration testing experiments, which inherently differ from CTF challenges. In real-world scenarios, targets, methods, and boundaries are strictly contract-defined, prohibiting risky payloads or actions that could impact services (crashes, lockouts, data loss). The focus was on internal penetration testing, specifically Active Directory (AD) based privilege escalation, which offers several benefits: protecting enterprise authentication backbones, enabling realistic kill chain simulations, and providing a comprehensive attack surface.

To support AD penetration testing, the team utilized AutomatedLab, an open-source PowerShell module that automates the deployment of Active Directory environments. This tool allows defining entire topologies as code, deploying them rapidly, and reproducing identical environments, ensuring consistency for agent validation.

Three AD-focused scenarios were used for evaluation:

1. Shared Folder Misconfiguration: A technically simple but highly impactful scenario where a domain file server contains a shared directory with overly permissive access, exposing confidential data (e.g., plain text notes, configuration files with credentials). The agent's goal was to enumerate the folder structure and detect files containing credentials or secrets. The agent performed as expected, quickly inferring sensitive items from file names and context, effectively turning a noisy folder into a prioritized risk list.
2. GPO CPassword Issue: This scenario addresses a well-known legacy Active Directory vulnerability where Group Policy Preferences files in Sysvol contain deprecated encrypted passwords. The agent successfully located the GPO files, used a published AES key to decrypt the values, and reused the credentials to complete the attack chain. The integration of Hacktoria command patterns into the agent's setup made this process straightforward, akin to following a checklist.
3. NTLM Relay combined with Resource-Based Constrained Delegation (RBCD) Abuse: This was the most complex scenario, involving an intricate attack chain for privilege escalation without needing passwords or manual ticket forging. The agent successfully generated every command, and each step worked when triggered manually. However, a significant limitation was encountered: NTLM relay requires parallel execution (one shell running a listener, another triggering forced authentication). This type of concurrency proved difficult to coordinate purely through LLM-driven orchestration, preventing complete hands-off automation. Despite this, the individual steps (machine account creation, RBCD assignment, Kerberos ticket retrieval, final privileged access) were functionally correct. This challenge is identified as a key technical hurdle for future work rather than a fundamental limitation of the agentic approach.

Overall, these real-world inspired test cases demonstrated the practical effectiveness of integrating agentic AI into internal penetration testing workflows, particularly in identifying misconfigurations and exploiting known vulnerabilities within complex enterprise environments.

Demo / Proof of Concept

▶ Watch: Active Directory privilege escalation: focus scenarios (30:00)

While the talk did not feature a live, end-to-end demonstration of the entire framework, the detailed exposition of the N8N-orchestrated workflow and the results from the CTF-based and real-world Active Directory scenarios served as a comprehensive proof of concept. The step-by-step breakdown of how the Planner, Executor, Guardian, and Verifier agents interact, coupled with the successful execution of tasks like SQL injection and the GPO CPassword exploit, effectively showcased the framework's capabilities.

The real-world AD scenarios, in particular, acted as a demonstration of the system's practical application, illustrating how it could enumerate shared folders, decrypt credentials from GPO files, and even formulate commands for complex NTLM Relay + RBCD attacks. Although the NTLM Relay scenario highlighted a current limitation in coordinating parallel execution, the fact that individual commands worked when manually triggered underscores the agent's underlying intelligence and planning ability.

Towards the end of the presentation, a brief, additional demonstration was provided, showing the integration of BloodHound with Cypher queries within the N8N environment. This illustrated how GUI-based operations, common in security analysis, could be seamlessly integrated into the agentic workflow, allowing the agent to natural language queries like "who are domain admins" and leverage BloodHound's relationship visualization capabilities. This segment served as a quick, forward-looking proof of concept for deeper tool integration.

Defensive Implications

▶ Watch: Q&A: Customer trust in AI vs. human, EDR (44:00)

The advent of agentic AI in penetration testing presents several significant implications for defenders, offering both opportunities for enhanced security and new considerations for defense strategies.

Firstly, agentic AI systems can serve as powerful tools for proactive vulnerability discovery. By tirelessly enumerating and analyzing systems, these agents can rapidly identify common misconfigurations (such as overly permissive shared folders), detect lingering legacy vulnerabilities (like the GPO CPassword issue), and even map out complex attack paths (like NTLM Relay + RBCD). This automated, high-volume scanning and analysis capability can significantly shorten the time to discover vulnerabilities that might otherwise be missed or take extensive manual effort.

Secondly, the ability of these agents to process unstructured data and prioritize risks is invaluable. As demonstrated with the shared folder scenario, an agent can transform "a noisy, unstructured folder into a prioritized list of risk in seconds," allowing security teams to focus their remediation efforts on the most impactful findings. This efficiency translates into faster patch cycles and a more resilient security posture.

Thirdly, the framework's emphasis on automated reporting directly addresses a major pain point in traditional pentesting. By reducing the overhead of documentation, it enables security teams to receive actionable intelligence more quickly, facilitating rapid integration with existing dashboards or ticketing systems and accelerating the remediation process.

Furthermore, by simulating realistic kill chain attacks that mirror actual attacker movements (initial access, lateral movement, privilege escalation), agentic AI can help defenders understand and test their defenses against sophisticated threats. This provides a dynamic way to validate security controls and identify gaps in detection and response capabilities before real attackers exploit them.

The concept of a Guardian agent enforcing safety and governance is also a crucial takeaway for defenders. As automation in security grows, implementing robust guardrails and policy checks becomes paramount to prevent accidental damage or out-of-scope activities. Defenders should consider building similar control layers for any automated security tools they deploy.

However, the talk also highlights areas where human expertise remains indispensable. The speaker explicitly noted that the current experiments have not yet tested against environments with EDR (Endpoint Detection and Response) or other modern security software. This means that while agentic AI can identify vulnerabilities, its ability to bypass or operate undetected in a heavily defended environment is still an open question. Defenders must continue to rely on human pentesters for validating findings in protected environments and developing sophisticated evasion techniques. Additionally, the challenge in coordinating parallel execution for complex attacks like NTLM Relay underscores that advanced, multi-stage exploits still require significant human oversight and ingenuity.

In summary, defenders should embrace agentic AI to augment their capabilities in rapidly identifying common vulnerabilities and misconfigurations. However, they must maintain a strong human element for complex scenarios, EDR bypass testing, and validating the real-world impact of automated findings within their unique security architectures.

Key Takeaways

• Agentic AI significantly advances penetration testing automation by integrating autonomous reasoning, self-directed planning, intelligent tool usage, and continuous self-correction throughout the entire pentesting lifecycle.
• Structured workflows and system design are paramount for predictable agent behavior and effective operation, often proving more critical than the raw computational power or size of the underlying LLM.
• Agentic AI excels at identifying misconfigurations and known vulnerabilities in real-world Active Directory environments, offering substantial time savings in tasks like shared folder enumeration and GPO CPassword exploitation.
• Current bottlenecks are primarily in execution orchestration, environmental handling, and parallel task control, rather than the core intelligence or decision-making capabilities of the LLM agents.
• Low-code automation platforms like N8N are powerful orchestrators for building and managing multi-agent workflows, providing a self-hosted, visual, and rapidly evolving foundation for secure security automation.
• Future development will focus on integrating local LLMs, refining agent behavior through reinforcement learning, and leveraging tools like BloodHound and Cypher more deeply for advanced orchestration and contextual understanding.

About the Speaker(s)

Hiroaki Toyota is an AI Technology Department Member at LAC Corporation. His primary focus is on applying advanced AI technologies, particularly machine learning and deep learning, to the cybersecurity domain. While he had a background in AI prior to the emergence of large language models, he is relatively new to the security industry, having joined LAC Corporation earlier this year and attending CODE BLUE for the first time. Despite his recent entry into cybersecurity, Toyota is a passionate advocate for combining AI and security, actively participating in CTFs, and is committed to tackling the numerous challenges within this evolving field.