VEXAIoT: Autonomous Multi-Agent LLM Framework Automates End-to-End IoT Vulnerability Discovery and Exploitation (95% Success Rate) — Threadlinqs Intelligence
As of 2026-07-13, VEXAIoT: Autonomous Multi-Agent LLM Framework Automates End-to-End IoT Vulnerability Discovery and Exploitation (95% Success Rate) is a medium-severity tool threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1261 · Severity: MEDIUM · Status: ACTIVE · Category: TOOL
Academic researchers (Swinea, Aryal, Praharaj, Gupta) published VEXAIoT, a two-agent LLM framework (ChatGPT 5.1 thinking) that chains Nmap reconnaissance, Searchsploit/Exploit-DB lookups, Bettercap,
VEXAIoT ("Vulnerability EXploitation using AI Agents") is a research framework published on arXiv (2607.09653, submitted 2026-07-10, CC BY 4.0) by Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, and Maanak Gupta, first reported publicly by Cyber Security News on 2026-07-13. The system decomposes offensive IoT security assessment into a modular multi-agent pipeline: reconnaissance -> vulnerability mapping -> attack planning -> execution -> validation.
Architecturally, VEXAIoT uses two cooperating agents built on ChatGPT 5.1 ("thinking" reasoning mode): a Vulnerability Detection Agent that runs Nmap-driven reconnaissance to enumerate hosts, open ports, exposed services, and software versions, then correlates discovered software against known CVEs via Searchsploit and Exploit-DB; and an Attack Execution Agent that consumes the detection agent's findings, selects an appropriate offensive tool (Nmap NSE scripts, Searchsploit-sourced PoC exploits, Bettercap for MITM/traffic interception, John the Ripper for password cracking), generates the exact command sequence, executes it, and validates success using LLM-based interpretation of tool output. When a command fails, the LLM revises its approach using error-message feedback and retry logic rather than following a rigid, pre-scripted playbook -- the paper's central claim of novelty versus prior CTF-focused LLM pentesting tools such as PentestGPT, AutoAttacker, and AutoPentester.
The authors deliberately used functional, non-malicious tool-description framing in their prompts specifically to reduce LLM safety-refusal behavior during offensive tasking -- a prompt-engineering technique with dual-use implications for real-world adversarial automation, since it demonstrates a working method to lower a commercial LLM's resistance to producing exploit commands.
Evaluation targeted two intentionally vulnerable testbeds: IoTGoat (OWASP's deliberately insecure OpenWrt-based IoT firmware, containing MiniUPnP 2.1 DoS flaws CVE-2019-12108/12109/12110/12111 and libuci use-after-free CVE-2020-28951) and Metasploitable2 (a classic vulnerable Linux distribution whose exploited services in this study align with the well-known vsftpd 2.3.4 backdoor CVE-2011-2523 and distcc remote command execution CVE-2004-2687). Across 260 total execution runs mapped to 10 OWASP IoT Top 10 categories, VEXAIoT achieved 247/260 (95.0%) successful exploitations: 189/200 (94.5%) on IoTGoat and 58/60 (96.7%) on Metasploitable2. Seven of ten scenarios (XSS injection, developer backdoor access, malicious update execution, database PII extraction, log erasure, and RCE) reached 100% success; MiniUPnP backdoor abuse and DNS DoS scenarios lagged at 80% due to command-syntax generation errors and model refusals. Parallelized execution completed all 10 attack scenarios in ~3 minutes 50 seconds versus ~8 minutes 31 seconds sequentially. Of the 13 failures, the paper attributes 5 to model refusals, 5 to LLM-generated command syntax errors, and 1 to model hallucination (2 unaccounted/other in the reported breakdown).
No CVE was assigned to VEXAIoT itself (it is a research tool/methodology, not a vulnerability), and no threat-actor adoption or in-the-wild use has been reported. The risk profile is that of a capability-lowering dual-use tool: it demonstrates that commodity multi-agent LLM tooling can autonomously chain reconnaissance-to-exploitation against IoT/embedded Linux targets with high reliability and low cost, shortening the skill and time barrier previously required for manual IoT penetration testing or malicious exploitation. The authors explicitly scope the work to isolated, authorized testbeds and recommend production/real-world deployment safeguards: strict access controls, comprehensive action logging, mandatory human approval gates for sensitive actions, and technical guardrails preventing agents from reaching hosts outside an approved test scope. They acknowledge that autonomous exploit execution at scale requi
Weaknesses (CWE)
CWE-798, CWE-77, CWE-79, CWE-284, CWE-494, CWE-476, CWE-416, CWE-306
Target sectors: technology, iotmanufacturing, criticalinfrastructure, consumerelectronics, researchacademia
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
TOOL, MEDIUM, threat intelligence, cybersecurity, CVE-2011-2523, CVE-2004-2687, CVE-2019-12108, CVE-2019-12109, CVE-2019-12110, CVE-2019-12111, CVE-2020-28951, T1595.002, T1592.002, T1588.005, T1588.002, T1190, T1078.001, T1059.004, T1505.003, T1068, T1070.002