VEXAIoT: Autonomous Multi-Agent LLM Framework Automates End-to-End IoT Vulnerability Discovery and Exploitation (95% Success Rate)

VEXAIoT: Autonomous Multi-Agent LLM Framework Automates (TL-2026-1261), also tracked as VEXAIoT, is a medium-severity tool threat, first published 2026-07-13. It has no confirmed attribution, affects OWASP IoTGoat, references 7 CVEs (CVE-2011-2523, CVE-2004-2687, CVE-2019-12108), maps to 22 MITRE ATT&CK techniques (T1005, T1041, T1046), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1261

Threat ID
TL-2026-1261
Also known as
VEXAIoT, Vulnerability EXploitation using AI Agents, VEXA_IoT
Severity
MEDIUM
Status
ACTIVE
Category
TOOL
First published
2026-07-13
Last reviewed
2026-07-13
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, iotmanufacturing, criticalinfrastructure, consumerelectronics, researchacademia
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

Malware and tooling: vsftpd 2.3.4 trojaned backdoor, Bettercap, Exploit-DB, John the Ripper, Nmap, Searchsploit, VEXAIoT

Academic researchers (Swinea, Aryal, Praharaj, Gupta) published VEXAIoT, a two-agent LLM framework (ChatGPT 5.1 thinking) that chains Nmap reconnaissance, Searchsploit/Exploit-DB lookups, Bettercap, and John the Ripper into autonomous, dependency-aware IoT attack plans. Tested against IoTGoat and Metasploitable2 across 260 executions covering 10 OWASP IoT Top 10 attack scenarios (hardcoded password cracking, MiniUPnP backdoor abuse, XSS injection, developer backdoor access, malicious firmware update execution, DNS DoS, database PII extraction, MitM credential interception, log erasure, and RCE), it achieved a 95% overall success rate (94.5% on IoTGoat, 96.7% on Metasploitable2) with most attacks completing in under two minutes and low token overhead (460-1,480 tokens/attack).

How VEXAIoT: Autonomous Multi-Agent LLM Framework Automates works

VEXAIoT ("Vulnerability EXploitation using AI Agents") is a research framework published on arXiv (2607.09653, submitted 2026-07-10, CC BY 4.0) by Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, and Maanak Gupta, first reported publicly by Cyber Security News on 2026-07-13. The system decomposes offensive IoT security assessment into a modular multi-agent pipeline: reconnaissance -> vulnerability mapping -> attack planning -> execution -> validation.

Architecturally, VEXAIoT uses two cooperating agents built on ChatGPT 5.1 ("thinking" reasoning mode): a Vulnerability Detection Agent that runs Nmap-driven reconnaissance to enumerate hosts, open ports, exposed services, and software versions, then correlates discovered software against known CVEs via Searchsploit and Exploit-DB; and an Attack Execution Agent that consumes the detection agent's findings, selects an appropriate offensive tool (Nmap NSE scripts, Searchsploit-sourced PoC exploits, Bettercap for MITM/traffic interception, John the Ripper for password cracking), generates the exact command sequence, executes it, and validates success using LLM-based interpretation of tool output. When a command fails, the LLM revises its approach using error-message feedback and retry logic rather than following a rigid, pre-scripted playbook -- the paper's central claim of novelty versus prior CTF-focused LLM pentesting tools such as PentestGPT, AutoAttacker, and AutoPentester.

The authors deliberately used functional, non-malicious tool-description framing in their prompts specifically to reduce LLM safety-refusal behavior during offensive tasking -- a prompt-engineering technique with dual-use implications for real-world adversarial automation, since it demonstrates a working method to lower a commercial LLM's resistance to producing exploit commands.

Evaluation targeted two intentionally vulnerable testbeds: IoTGoat (OWASP's deliberately insecure OpenWrt-based IoT firmware, containing MiniUPnP 2.1 DoS flaws CVE-2019-12108/12109/12110/12111 and libuci use-after-free CVE-2020-28951) and Metasploitable2 (a classic vulnerable Linux distribution whose exploited services in this study align with the well-known vsftpd 2.3.4 backdoor CVE-2011-2523 and distcc remote command execution CVE-2004-2687). Across 260 total execution runs mapped to 10 OWASP IoT Top 10 categories, VEXAIoT achieved 247/260 (95.0%) successful exploitations: 189/200 (94.5%) on IoTGoat and 58/60 (96.7%) on Metasploitable2. Seven of ten scenarios (XSS injection, developer backdoor access, malicious update execution, database PII extraction, log erasure, and RCE) reached 100% success; MiniUPnP backdoor abuse and DNS DoS scenarios lagged at 80% due to command-syntax generation errors and model refusals. Parallelized execution completed all 10 attack scenarios in ~3 minutes 50 seconds versus ~8 minutes 31 seconds sequentially. Of the 13 failures, the paper attributes 5 to model refusals, 5 to LLM-generated command syntax errors, and 1 to model hallucination (2 unaccounted/other in the reported breakdown).

No CVE was assigned to VEXAIoT itself (it is a research tool/methodology, not a vulnerability), and no threat-actor adoption or in-the-wild use has been reported. The risk profile is that of a capability-lowering dual-use tool: it demonstrates that commodity multi-agent LLM tooling can autonomously chain reconnaissance-to-exploitation against IoT/embedded Linux targets with high reliability and low cost, shortening the skill and time barrier previously required for manual IoT penetration testing or malicious exploitation. The authors explicitly scope the work to isolated, authorized testbeds and recommend production/real-world deployment safeguards: strict access controls, comprehensive action logging, mandatory human approval gates for sensitive actions, and technical guardrails preventing agents from reaching hosts outside an approved test scope. They acknowledge that autonomous exploit execution at scale requires stronger command validation and safety controls before any responsible real-world use, and note the study does not reflect production-network complexity (patched software, IDS/IPS, network segmentation, device heterogeneity) that would degrade success rates outside a lab.

MITRE ATT&CK techniques used in TL-2026-1261

Collection

T1005 Data from Local System; T1557.003 DHCP Spoofing

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110.002 Password Cracking; T1552.001 Credentials In Files; T1557 Adversary-in-the-Middle

Impact

T1495 Firmware Corruption; T1498 Network Denial of Service; T1565 Data Manipulation

Persistence

T1505.003 Web Shell

Resource Development

T1588.002 Tool; T1588.005 Exploits

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

defense-impairment

T1685.006 Clear Linux or Mac System Logs

Affected products and versions in VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

  • OWASP — IoTGoat
    Vulnerable versions: all released images with default MiniUPnP 2.1 / vulnerable libuci
    Fixed in: not applicable — deliberately vulnerable training firmware
  • Rapid7 / community — Metasploitable2
    Vulnerable versions: all released images (vsftpd 2.3.4, distccd)
    Fixed in: not applicable — deliberately vulnerable training image
  • MiniUPnP Project — MiniUPnP daemon
    Vulnerable versions: 2.1 and prior versions affected by CVE-2019-12108/12109/12110/12111
    Fixed in: patched releases post-2019 disclosure
  • vsftpd project (trojaned archive) — vsftpd
    Vulnerable versions: 2.3.4 (trojaned distribution, June 30-July 1 2011)
    Fixed in: current official vsftpd releases
  • distcc — distccd
    Vulnerable versions: configurations exposing distccd without access control (CVE-2004-2687)
    Fixed in: restrict/disable distccd remote access
  • OpenWrt — libuci
    Vulnerable versions: before 18.06.9 and 19.x before 19.07.5 (CVE-2020-28951)
    Fixed in: 18.06.9+; 19.07.5+

Remediation for VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

Patches

  • Apply MiniUPnP patches addressing CVE-2019-12108, CVE-2019-12109, CVE-2019-12110, CVE-2019-12111
  • Apply OpenWrt libuci patch for CVE-2020-28951 (18.06.9+ / 19.07.5+)
  • Remove/replace vsftpd builds affected by the 2011 backdoor trojan (CVE-2011-2523) with a clean, current vsftpd release
  • Disable distccd or restrict to trusted build networks only, patching/mitigating CVE-2004-2687

Immediate actions

  • Patch/replace known-vulnerable IoT and Linux services that map to the ten demonstrated OWASP IoT attack scenarios (weak/hardcoded credentials, exposed UPnP services, unauthenticated ecosystem interfaces, unsigned firmware update mechanisms, verbose DNS services, unencrypted data-in-transit, default/insecure configurations enabling RCE)
  • Disable or firewall MiniUPnP and other UPnP services on IoT gateways/routers unless explicitly required, and patch to versions beyond CVE-2019-12108/12109/12110/12111
  • Remove or upgrade vsftpd 2.3.4 and distccd installations still exposed on any Linux hosts (CVE-2011-2523, CVE-2004-2687) — legacy Metasploitable-class misconfigurations recur in real IoT/edge deployments
  • Enforce unique, non-default credentials on all IoT/embedded management interfaces to blunt automated hardcoded-password-cracking attack chains
  • Deploy network segmentation isolating IoT/OT devices from core enterprise networks to blunt lateral movement from any single compromised device

Workarounds

  • Restrict management/API interfaces (UPnP, FTP, distcc, web admin) to trusted internal networks via firewall/ACL
  • Disable unauthenticated remote administration on IoT devices where not operationally required
  • Rate-limit and alert on rapid sequential port scans followed by service-specific exploit attempts from a single source

Longer-term hardening

  • Deploy behavioral/EDR-style monitoring on IoT gateways and embedded Linux devices capable of detecting rapid, automated recon-to-exploit command sequences (Nmap sweeps followed by exploit tool invocation within seconds)
  • Establish a firmware/software update validation and integrity-verification process (signed updates) to prevent malicious-update-style attack chains
  • Adopt IoT-specific threat modeling aligned to the OWASP IoT Top 10 during procurement and device lifecycle management
  • Track emerging LLM-driven offensive automation frameworks (VEXAIoT-class tooling) as a maturing threat category and update detection engineering accordingly

CVEs associated with VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

CVE-2011-2523, CVE-2004-2687, CVE-2019-12108, CVE-2019-12109, CVE-2019-12110, CVE-2019-12111, CVE-2020-28951

Weaknesses (CWE) in VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

CWE-798, CWE-77, CWE-79, CWE-284, CWE-494, CWE-476, CWE-416, CWE-306

Timeline of VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

  • distcc remote command execution vulnerability (CVE-2004-2687) disclosed; remains present in Metasploitable2 as a VEXAIoT test target
  • Malicious backdoor trojan (CVE-2011-2523) inserted into the vsftpd 2.3.4 download archive, later used as one of VEXAIoT's Metasploitable2 test targets
  • MiniUPnP 2.1 NULL pointer dereference DoS vulnerabilities (CVE-2019-12108/12109/12110/12111) disclosed, later included in IoTGoat's vulnerable service set
  • OpenWrt libuci use-after-free vulnerability (CVE-2020-28951) disclosed, present in OpenWrt versions used by IoTGoat firmware
  • PentestGPT (arXiv:2308.06782), an earlier LLM-empowered automatic penetration testing tool later presented at USENIX Security 2024, is submitted to arXiv; VEXAIoT's authors position their framework as advancing beyond PentestGPT's largely CTF-focused, more manually-guided approach toward fully autonomous end-to-end IoT exploitation
  • Swinea, Aryal, Praharaj, and Gupta submit the VEXAIoT paper (arXiv:2607.09653), describing the multi-agent LLM framework and its 260-run IoTGoat/Metasploitable2 evaluation
  • TL-Intel-Harness HUNT phase flags VEXAIoT via RSS ingestion (Cyber Security News feed) as an emerging AI-driven offensive-tooling threat relevant to SOC detection priorities
  • Cyber Security News and Arabian Post publish articles covering VEXAIoT's 95% automated IoT exploitation success rate, bringing the research to broader security-community attention

Sources cited for VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

Threats related to VEXAIoT: Autonomous Multi-Agent LLM Framework Automates

Detection coverage for TL-2026-1261

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1261 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats