Original title: Big Enough to Break Out: Tracking the Rising Capability of LLM Penetration-Testing Agents
Victoria Lovelace, Cameron Berryman, Yuhan You, Suhas Reddy Adavelly +2 · September 2026
Security experts use large language models to find weaknesses in computer systems, a practice called penetration testing. But we still know little about how capable these artificial intelligence agents really are or why they get stuck. To find out, researchers compared an older agent guided by humans against a newer, fully automated agent. They tested both systems on three public target machines. The automated tool solved all three targets. The older tool failed to solve two of them, but it still completed about half the subtasks on ordinary university hardware without safety guardrails. When tests stalled, the problem was not forgetting past clues. Instead, the agents simply failed to turn clues they already held into working attack plans. Adding a special memory layer did not improve their results. Finally, defenders can use this same subtask scoring to measure offensive abilities as they grow.
You are trying to build a model airplane from a picture, without the instructions. You study the diagram and identify all the parts: the wings, the fuselage, the tail. But you never actually glue any piece to another, because you are not sure which goes where first. So the plane stays in pieces, even though you have everything you need. In this paper, the AI had gathered all the evidence needed to break into a system but never turned that evidence into a specific attack command, much like having the parts but never assembling them.
This shows even a free, open-weight AI on a student GPU can do half the work of a penetration test it fails to finish. It reveals the next leap in attacker AI will likely come from better planning, not bigger memory. Defenders can now measure how close any AI is to full success by scoring its subtask completion.
The study cannot separate which factor (model, harness, autonomy, or memory architecture) causes performance differences. The planning insight comes from a limited review of stalled legacy runs and may not generalize. Results are based on only three public targets.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Big Enough to Break Out: Tracking the Rising Capability of LLM Penetration-Testing Agents — Victoria Lovelace, Cameron Berryman, Yuhan You et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.