Staying on the Attack Path: Structured State for Long-Horizon Automated Penetration Testing

arXiv:2609.07344 · cs.CR, cs.AI · Submitted 2026-09-07 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-07

Updated: 2026-09-18

Code: https://github.com/anmolksachan/AI-ML-Free-Resources-for-Securityand-Prompt-Injection

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Ablation — 18× in this paper · explained in 1 episode
• Core — 11× in this paper · explained in 2 episodes
• Verification — 10× in this paper · explained in 2 episodes
• Benchmark — 9× in this paper · explained in 2 episodes
• Ablation study — 8× in this paper · explained in 1 episode
• Hallucination — 8× in this paper · explained in 3 episodes
• Causal Reasoning — 6× in this paper · explained in 2 episodes
• RAG — 5× in this paper · explained in 3 episodes
• Consistency — 4× in this paper · explained in 3 episodes
• Cosine Similarity — 4× in this paper · explained in 3 episodes
• Reinforcement Learning — 4× in this paper · explained in 4 episodes
• Alignment — 3× in this paper · explained in 1 episode
• Generalization — 3× in this paper · explained in 13 episodes
• Capture The Flag — 2× in this paper
• Cognitive Load — 2× in this paper · explained in 2 episodes
• Graph Construction — 2× in this paper · explained in 3 episodes
• Large Language Model (LLM) — 2× in this paper · explained in 3 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• State Management — 2× in this paper · explained in 3 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Abstraction — 1× in this paper · explained in 1 episode
• Action Space — 1× in this paper · explained in 1 episode
• Adaptation — 1× in this paper · explained in 1 episode
• Agent Harness — 1× in this paper · explained in 2 episodes
• Analyzer — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 3 episodes
• Chain-of-Thought Prompting — 1× in this paper · explained in 2 episodes
• Embeddings — 1× in this paper · explained in 2 episodes
• Failure Modes — 1× in this paper · explained in 3 episodes
• Fidelity — 1× in this paper · explained in 2 episodes
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• Formal Methods — 1× in this paper · explained in 3 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• Hypergraph — 1× in this paper · explained in 2 episodes
• Knowledge Graph — 1× in this paper · explained in 7 episodes
• Knowledge graphs — 1× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Multi-agent Collaboration — 1× in this paper · explained in 2 episodes
• Multi-agent Collaborative Framework — 1× in this paper · explained in 2 episodes
• Online Reinforcement Learning — 1× in this paper · explained in 2 episodes
• Partially observable Markov decision process (POMDP) — 1× in this paper · explained in 2 episodes
• Structural Constraints — 1× in this paper · explained in 2 episodes
• Transferability — 1× in this paper · explained in 4 episodes

Sources

• Integrating DAST in Kanban and CI/CD: A Real World Security Case Study
• CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Models
• CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models
• Lost in the Middle: How Language Models Use Long Contexts
• Unlocking User-oriented Pages: Intention-driven Black-box Scanner for Real-world Web Applications
• What Makes a Good LLM Agent for Real-world Penetration Testing?
• Automated Penetration Testing with LLM Agents and Classical Planning
• VulnBot: Autonomous Penetration Testing for A Multi-Agent Collaborative Framework
• APT-Agent: Automated Penetration Testing using Large Language Models
• PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design
• The Rise of AI Teammates in Software Engineering (SE) 3.0: How Autonomous Coding Agents Are Reshaping Software Engineering
• Pentest-R1: Towards Autonomous Penetration Testing Reasoning Optimized via Two-Stage Reinforcement Learning
• Cyber-Zero: Training Cybersecurity Agents without Runtime
• From Local to Global: A Graph RAG Approach to Query-Focused Summarization
• Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening
• Voyager: An Open-Ended Embodied Agent with Large Language Models
• DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs