Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation

arXiv:2607.11288 · cs.CR, cs.AI, cs.MA · Submitted 2026-07-13 · Read on arXiv

Praneeth Narisetty, Shiva Nagendra Babu Kore

cs.CR, cs.AI, cs.MA

Submitted: 2026-07-13

Comments: 13 pages, 10 figures, 8 tables

Code: https://github.com/0ca/BoxPwnr-Traces

Project page: https://launchsafe.com

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Benchmark — 52× in this paper · explained in 2 episodes
• Verification — 15× in this paper · explained in 2 episodes
• Trace — 13× in this paper · explained in 2 episodes
• Core — 5× in this paper · explained in 2 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Graph Construction — 1× in this paper · explained in 3 episodes
• Introspection — 1× in this paper · explained in 2 episodes
• Iterative Refinement — 1× in this paper · explained in 3 episodes
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• LLM Agents can Autonomously Hack Websites
• LLM Agents can Autonomously Exploit One-day Vulnerabilities
• Gemini: A Family of Highly Capable Multimodal Models
• FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance
• The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation
• Multi-Agent Penetration Testing AI for the Web

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs