Penetration testing has always been a deeply human craft. Skilled security professionals spend hours, sometimes days, manually probing networks, enumerating services, and chaining together obscure software flaws into working exploits. As information systems grow increasingly complex and cyberattack techniques continue to evolve, this reliance on manual expertise faces serious challenges in both efficiency and scalability. The shortage of qualified pentesters means most organizations simply cannot test their systems as often or as thoroughly as the threat landscape demands. PentestMCP was designed to close that gap by letting language models orchestrate the entire offensive security workflow, from the first reconnaissance scan to the final exploitation payload.

The technical heart of the framework rests on three synergistically coupled mechanisms. The first is MCP-centered pentesting tool orchestration. The Model Context Protocol, or MCP, is an emerging standard for connecting language models to external software tools in a structured, standardized way. Rather than forcing an AI to invent shell commands from scratch and hope they work, PentestMCP wraps established security tools, the kind found in the Kali Linux distribution, behind standardized capability invocations. The system can call network scanners such as Nmap, SQL injection tools such as Sqlmap, and exploitation frameworks such as Metasploit through a consistent interface, which dramatically reduces the hallucination and formatting errors that plague naive LLM tool use.

The second mechanism is dynamic closed-loop scheduling built on what the authors call a PTG, a pentesting task graph that the agents continuously decompose, update, and reflect upon. Instead of following a rigid, pre-programmed checklist, the system treats each engagement as a directed graph of tasks that evolves as new information arrives. When a reconnaissance agent discovers an unexpected service or an unusual software version, the graph is rewritten on the fly, new subtasks are spawned, and completed branches are pruned. This closed loop of task decomposition and reflection allows the agents to behave less like scripts and more like human operators who adapt their strategy mid-engagement, a property the authors demonstrate in detailed appendices showing how the task graph for a well-known Hack The Box challenge called Shocker was initialized, updated, and finalized across the reconnaissance, enumeration, and exploitation stages.

The third and perhaps most novel mechanism is a dual-path exploitation policy featuring continuous learning. When the system encounters a vulnerability, it dynamically balances two strategies: precise knowledge retrieval from an existing exploit database and generative adaptability, where the language model reasons from first principles about how a flaw might be abused. If the retrieval path finds a known exploit pattern, the system executes it with high precision. If the vulnerability is unfamiliar, the generative path attempts to construct a novel exploitation strategy. Crucially, whenever the generative path succeeds in producing a new exploit path, that success is deposited back into the knowledge base, meaning the system literally teaches itself with every engagement. Over time, the fraction of vulnerabilities that require creative reasoning shrinks as the library of validated exploits grows.

The evaluation was extensive and grounded in reality rather than synthetic benchmarks. The team tested PentestMCP against more than one hundred real-world vulnerabilities spanning diverse CWE categories, the Common Weakness Enumeration taxonomy that classifies software flaws by type, and varying complexity levels. Experimental results show that PentestMCP consistently achieves higher success rates, execution accuracy, and efficiency than existing baselines while also reducing execution time. The baselines included earlier LLM-driven pentesting systems such as PentestGPT, which was evaluated at the USENIX Security Symposium, as well as multi-agent collaborative frameworks like Vulnbot and PentestAgent. The consistent outperformance across all three pentesting phases, reconnaissance, vulnerability discovery, and exploitation, suggests the architectural choices, standardized tool invocation, adaptive scheduling, and dual-path learning, compound rather than merely add up.

The phase-by-phase numbers deserve scrutiny because they reveal where AI currently excels and where it still struggles. Information gathering, at 87.2 percent success, is the phase where language models shine brightest, since it involves calling scanners, parsing outputs, and synthesizing findings, tasks well suited to LLM reasoning over structured tool responses. Vulnerability discovery, at 74.0 percent, requires correlating observed software versions and configurations with known CVE entries, a knowledge-intensive task where retrieval-augmented generation helps but hallucination risks remain. Exploitation, at 64.9 percent, is the hardest phase, since it demands chaining multiple steps, crafting payloads, and adapting to defensive measures in real time. The gradient across phases mirrors the expertise gradient of human pentesters, which is precisely why the researchers consider the results a meaningful benchmark of genuine capability rather than a parlor trick.

Underneath the headline results lies a sophisticated engineering stack. The knowledge base is backed by MongoDB, exploits and tool outputs are embedded using the all-MiniLM-L6-v2 sentence-transformer model and matched via cosine similarity, and task graphs are ordered using topological sorting over directed acyclic graphs. The dual-path policy draws on retrieval-augmented generation, the technique popularized by Lewis and colleagues at Facebook AI Research that grounds LLM outputs in retrieved documents rather than relying purely on parametric memory. By combining RAG with generative exploration, PentestMCP hedges against the two failure modes that have historically limited AI in security work: rigid systems that cannot handle novel situations and flexible systems that hallucinate plausible but wrong commands.

Yet the same capabilities that make PentestMCP valuable to defenders make it a potential weapon in the wrong hands. The researchers are candid about the dual-use dilemma, citing the growing literature on the malicious use of artificial intelligence and the taxonomy of risks posed by language models. Prompt injection attacks, where adversaries embed malicious instructions in data that LLM agents process, represent a particularly acute threat to agentic security systems, and recent work on indirect prompt injection in the wild and attacks on tool selection in LLM agents shows these risks are far from theoretical. There is also the alignment concern: as self-evolving LLM agents accumulate capabilities through continuous learning, ensuring they remain within authorized boundaries becomes an open research problem. The OWASP Top 10 for Large Language Model Applications now explicitly catalogs these threats, and the PentestMCP authors acknowledge that hallucination in large language models remains a fundamental challenge for any system that grants AI agents real offensive tooling.

What emerges from this study is a vivid picture of where cybersecurity is heading. Automated penetration testing driven by language models is no longer speculative; it is measurable, reproducible, and, in the case of PentestMCP, already outperforming earlier baselines across every phase of the offensive workflow. For defenders, systems like this promise to democratize rigorous security testing, letting organizations with modest budgets probe their infrastructure as often as needed rather than once a year. For attackers, the same frameworks lower the barrier to sophisticated intrusion. The research team, funded by the National Natural Science Foundation of China and several provincial programs, frames their work as a validation of substantial potential for advancement, but the deeper message may be more unsettling: the arms race between AI-powered offense and AI-powered defense has begun in earnest, and the systems that teach themselves with every hack are only going to get better.

Subject of Research: PentestMCP: LLM and MCP based multi-agent framework for automated penetration testing

Article Title: PentestMCP: LLM and MCP based multi-agent framework for automated penetration testing

Article References: Zhai, J., Zhou, X., Miao, H., Li, Z., Li, Z., & Yang, H. (2026). PentestMCP: LLM and MCP based multi-agent framework for automated penetration testing. Cluster Computing, 29(15), Article 854. https://doi.org/10.1007/s10586-026-06700-x

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06700-x

Keywords: cybersecurity, artificial intelligence, penetration testing, large language models, Model Context Protocol, multi-agent systems, vulnerability discovery, PentestMCP, based, multi-agent, framework, automated

The core insight behind BGVD-State is that the integrity of review state matters as much as the discovery of new candidate issues. In a typical AI-assisted review, one model may observe a suspicious pattern, another may attach evidence from a scanner, and a third may render a verdict. If the recipient of a handoff only receives a transcript or a summary, they cannot reliably tell which candidate owns which piece of evidence, whether that evidence is still current, which investigation routes have already failed, or which verification decision controls whether the finding can be reported. Stale, incomplete, or contradictory evidence can slip through, or worse, a candidate’s lifecycle can be silently corrupted across handoffs.

BGVD-State, whose historical name stands for Blackboard-Guided Vulnerability Discovery, draws on an idea that predates modern AI by decades: the blackboard architecture, in which independent knowledge sources collaborate by reading and writing to a shared problem-solving state. The Hearsay-II speech understanding system of 1980 popularized the approach, and recent LLM research has revisited blackboards for multi-agent collaboration. What the new software adds is an explicit evidence chain and a reporting gate. Crucially, BGVD-State is not itself a language model. It is deterministic middleware that sits between event producers, such as agents, tool wrappers, parsers, and human analysts, and state consumers, such as stronger models, reviewers, and reporting pipelines.

The architecture works through typed event records. Every tool call, observation, evidence update, invalidation, or review decision is appended to an event store with a unique identifier, preserving submission order. From these ordered records, the EvidenceLifecycle component derives candidate status, evidence binding, verifier currency, and failed paths. A FinalizationGate then decides whether a candidate may enter a report, returning an allow or reject decision with machine-readable reasons. The whole system enforces five invariants: evidence stays bound to its candidate until explicitly invalidated; a candidate requires current material evidence and a current positive verifier result before reporting; the newest verifier result always governs; rejected routes are carried into later handoff packages so successors do not repeat failed paths; and finalization excludes invalidated or superseded evidence.

Because these rules are enforced by deterministic code rather than by prompts, model forgetting, reinterpretation, or prompt-rule violations cannot alter execution after context compression or a provider change. This is a deliberate design choice with significant implications. When the software version, policy configuration, and event sequence are identical, every client obtains the same lifecycle state and gate decision. Replay validates each event’s structure before appending it, and an event rejected by validation leaves the state unchanged. The middleware does not, however, verify the substantive truth of client-supplied observations; that responsibility remains with the producers and verifiers.

The authors demonstrate the system on a third-party review of fixed public revisions of real open-source projects, including TypeScript, Django, and an elliptic-curve cryptography library. A workflow of 22 event records reconstructed six suspected-risk candidates. Five candidates were rejected along paths whose exclusion reasons are fully recorded within those events. The remaining candidate had a locally reproduced technical observation and an initial positive technical review, but a subsequent security-impact review concluded that the available evidence and tests did not establish a privilege or trust-boundary impact sufficient for reporting. That negative decision was appended as a 23rd event, and after replay, BGVD-State generated a handoff package containing the current states, evidence, and review results for all six candidates, with the complete decision trail preserved for audit.

Reproducibility is treated as a first-class concern. Version 1.2.0, released under the MIT license, runs on Python 3.10 through 3.12 with no runtime dependencies, and no-install reviewer kits are available for Windows x64 and macOS on both Apple Silicon and Intel. The regression suite of 130 tests covers legacy-input normalization, rejected-event state snapshots, and artifact-completeness checks, none of which require an API key or a model call. In a historical performance profile cycling through six fixed synthetic candidates across scales from 100 to 100,000 events, each scale produced a single stable state hash and handoff hash across five repetitions, with median replay time rising from under a millisecond to about 1.34 seconds at the largest scale.

The paper is notably candid about where the approach helps and where it does not. In historical memory-representation studies, a schema-guided state format outperformed matched free-form memory on selected high-pressure continuation fixtures, with a valid-output sensitivity analysis showing six wins, no losses, and 23 ties. But under reduced pressure, with information-equivalent prose, and in a cross-family source-audit setting, the advantage disappeared or reversed, and the authors explicitly present the source-audit result as a tested negative boundary. A token-cost comparison using GLM 5.2 and DeepSeek v4-pro found that a route in which local weaker models handle routine state curation consumed roughly 24,000 strong-model finalizer tokens with no strong-model update tokens, versus nearly 147,000 total strong-model tokens for strong-model curation, with both routes reaching correct final decisions in all 30 runs.

The practical vision is one of composable infrastructure. Orchestration frameworks such as LangGraph can keep workflow checkpoints, and multi-agent systems like AutoGen can coordinate agents and memory, while BGVD-State retains sole authority over security-review state and the reporting gate, presenting the same event, handoff, and gate interfaces to whichever client is attached. Teams can swap models, prompts, retrievers, or tool wrappers without changing the rules that determine which evidence remains current and whether a finding may be reported. A weaker local model can maintain routine state while stronger models or human reviewers receive the current package only when needed.

The authors are careful about the limits of their claims. The applied case used local copies of public repository revisions without interacting with live services, and no candidate is presented as a maintainer-confirmed vulnerability. The middleware implements one deterministic policy family, external clients remain responsible for authenticating event sources, and deployment-level gains in discovery rate, review time, or total cost are not established by the reported checks. Future work points toward multi-writer transactions, cryptographic event integrity, and signed handoff exchange for distributed deployment. Even so, BGVD-State offers something the fast-moving world of AI security agents has lacked: a provider-independent, replayable contract for carrying evidence and state across handoffs, ensuring that when an AI says a vulnerability is worth reporting, the entire chain of evidence behind that claim can be traced, replayed, and trusted.

Subject of Research: Replayable middleware for evidence-gated state handoffs in third-party software security review using AI agents

Article Title: BGVD-State: Replayable middleware for evidence-gated handoffs in third-party software security review

Article References: Lv, Y., & Wang, C. (2026). BGVD-State: Replayable middleware for evidence-gated handoffs in third-party software security review. SoftwareX, 36, Article 103109. https://doi.org/10.1016/j.softx.2026.103109

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103109

Keywords: BGVD-State, software security, LLM agents, vulnerability discovery, blackboard architecture, middleware, reproducibility, evidence chain, handoff, open source, cybersecurity, multi-agent systems

Binary protocols, which encode data directly as compact byte sequences rather than human-readable text, form the backbone of much of the modern digital world. They underpin network devices, industrial control systems, and Internet of Things applications, where efficiency and low overhead are paramount. But their very compactness creates a security blind spot. Unlike text protocols, binary formats lack delimiters, tags, and other redundant markers that make field boundaries obvious. When implementations of these protocols mishandle malformed messages, the consequences can be severe. The researchers point to the infamous EternalBlue vulnerability in the SMB protocol, which arose from improper parsing of binary messages and enabled buffer overflow and remote code execution with global impact, as a stark reminder of what is at stake.

Mutation-based greybox fuzzing has become one of the most widely used techniques for discovering such flaws. Greybox fuzzers occupy a middle ground between blackbox and whitebox approaches: they do not require complete knowledge of a program’s internals, but they do use lightweight runtime feedback, such as coverage information gathered through instrumentation, to guide how inputs are mutated. Tools like AFL, AFL++, and MOPT generate malformed test cases by applying mutation operators such as bit flips and byte substitutions to well-formed seed messages, then monitor the target program for crashes, hangs, and other abnormal behavior. The approach has uncovered countless vulnerabilities, yet the authors argue that existing fuzzers stumble when confronted with structured binary messages.

The team identifies three core challenges. First, protocol parsing is difficult because binary protocols represent data as bit streams with unclear field boundaries and implicit semantics, making it laborious to determine which positions in a message can safely be mutated. Second, evaluating the mutation value of different fields is hard because the effect of changing a field depends on runtime behavior, field dependencies, and the target program’s responses, none of which can be reliably determined statically. Third, and perhaps most damaging, existing fuzzers schedule mutation operators blindly. A bit flip applied to a function code field may drive a program into entirely new logical states, while the same operation on a data field merely alters content. Worse, mutating a length field without adjusting the corresponding payload breaks the message structure, causing the test case to be discarded before it ever reaches deep parsing logic.

MPAuzz tackles these problems in two stages. The first is a feedback-based mutation position exploration module that partitions protocol messages at bit-level granularity rather than the coarser byte level used by most prior tools. This fine granularity matters: in an MQTT message, for example, the high four bits of the header flags field determine the message type while the low four bits serve as flags, a distinction that byte-level analysis cannot capture. The module flips one bit at a time, sends the mutated message to the target, and classifies the result. Normal responses mark a bit as mutable; format anomalies detected with protocol parsing tools such as Tshark mark it as restricted; and mutations of essential control fields such as protocol names and function codes mark regions as immutable. Adjacent bits with similar properties are then merged into continuous regions, giving the fuzzer a map of where mutation is safe, where it must respect constraints, and where it is forbidden.

The second stage is where the ocean comes in. MPAuzz formulates mutation operator scheduling as a multidimensional optimization problem in which each dimension corresponds to the operator choice for one mutation region, and it solves this problem using the Marine Predators Algorithm, a metaheuristic inspired by how marine predators forage. The historically best operator combination plays the role of the predator, while candidate combinations act as prey. The algorithm dynamically switches between Lévy flights, long-distance jumps that enable broad exploration, and Brownian motion, small-step searches that enable fine-grained exploitation. The researchers deliberately chose MPA over alternatives such as multi-armed bandit strategies and particle swarm optimization because mutating one region of a binary message often depends on other regions; treating each region as an independent arm can produce structurally invalid test cases, while PSO’s velocity-based updates risk premature convergence when early coverage gains come from only a few regions.

The scheduling unfolds across three adaptive stages that mirror the fuzzing lifecycle. In the early, high-speed exploration stage, Lévy-distributed random vectors drive wide-ranging tests of operator combinations to avoid premature convergence. In the middle, balanced coordination stage, the population splits: half fine-tunes the elite combination using Brownian perturbations governed by a quadratically decreasing convergence factor, while the bottom-performing half continues exploring with Lévy motion. In the final, low-speed exploitation stage, an enhanced social learning term pulls candidate combinations toward the best-known strategy, changing only one or a few region assignments at a time. Crucially, a candidate combination is retained only if it satisfies region-specific constraints and improves coverage feedback. The framework also includes a repairing step for restricted regions: when a mutable payload region changes size, the associated length field is recalculated automatically, with nested dependencies repaired from the innermost region outward.

To validate the design, the team evaluated MPAuzz on four widely used binary protocol implementations covering MQTT, DTLS, DNS, and CoAP, comparing it against AFLNet and StateAFL, two of the most prominent greybox protocol fuzzers. Each fuzzer ran continuously for 24 hours per target, with each experiment repeated ten times to account for the inherent randomness of fuzzing. The results were decisive. MPAuzz’s valid-test-case ratio exceeded 97 percent on every target, compared with 83.1 percent for a multi-armed bandit variant and 79.5 percent for a PSO variant of the same tool. It reached comparable coverage 3.47 times faster than AFLNet and 2.22 times faster than StateAFL on average, with Vargha-Delaney effect sizes mostly at or above 0.85, indicating a consistent statistical advantage.

The vulnerability discovery results were equally compelling. Instrumenting targets with AddressSanitizer to capture memory-related faults, the researchers found that MPAuzz produced more crashes than both baselines on all four targets. On the Mosquitto MQTT broker, MPAuzz triggered an average of 87.8 crashes per run, compared with 3.9 for AFLNet and 43.2 for StateAFL, and exposed its first crash just 32 minutes into testing, whereas AFLNet failed to crash the target within the allotted time at all. On Tinydtls, MPAuzz found its first crash in 15 seconds. Analysis of the proof-of-concept inputs showed that the anomalies detected in Mosquitto and Libcoap correspond to real, documented vulnerabilities: the medium-severity CVE-2021-28166, a null pointer dereference triggered when an authenticated client sends a mutated SUBSCRIBE message before the server issues a PUBLISH message, and the high-severity CVE-2024-46304. These findings demonstrate that the fuzzer can surface genuine security flaws arising from abnormal protocol-state sequences, not merely superficial parsing errors.

The authors are candid about limitations. MPAuzz currently leans on external parsers such as Tshark and Scapy for protocol-format feedback, so for proprietary or undocumented protocols the precision of restricted and immutable region identification may degrade, though the fuzzer can still operate using runtime responses and coverage feedback alone. The automatic repair mechanism primarily supports length-related constraints; checksums, authentication fields, and state-dependent constraints require protocol-specific rules. The evaluation, while rigorous, covers four protocol implementations, and the team notes that additional targets and longer experiments would strengthen the evidence. Still, the work makes a persuasive case that combining protocol-aware region classification with staged, nature-inspired operator scheduling is a practical path forward for binary-protocol fuzzing, and the researchers plan to reduce reliance on external parsers and extend support for proprietary protocols with complex field dependencies in future work.

Subject of Research: A nature-inspired greybox fuzzing framework for discovering vulnerabilities in binary network protocol implementations

Article Title: Binary protocol greybox fuzzing driven by marine predators algorithm

Article References: Jiang, C., Hong, Z., Zhang, G., Li, Y., & Gu, J. (2026). Binary protocol greybox fuzzing driven by marine predators algorithm. Cybersecurity, 9(1), Article 214. https://doi.org/10.1186/s42400-026-00646-8

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00646-8

Keywords: binary protocols, greybox fuzzing, Marine Predators Algorithm, vulnerability discovery, mutation scheduling, network security, MQTT, DTLS, DNS, CoAP, software testing, cybersecurity