VEXAIoT, an autonomous multi-agent framework designed to discover and exploit vulnerabilities in the Internet of Things (IoT) within controlled test environments.
In 200 attack trials against the intentionally vulnerable IoTGoat platform, the system completed 189 attacks, achieving an overall success rate of 94.5% (rounded to 95%).
New VEXAIoT AI Agents Attack Workflow
VEXAIoT, short for Vulnerability Exploitation using AI Agents for IoT, utilizes two coordinated large language model (LLM) agents: a vulnerability-detection agent and an attack-execution agent.
The vulnerability-detection agent conducts reconnaissance, identifies exposed services and protocols, maps software to known vulnerabilities, and plans attack sequences.
Meanwhile, the attack-execution agent selects tools or public exploit scripts, generates commands, executes them, and reports the results.
The framework employs Nmap for network scanning, SearchSploit and Exploit-DB for vulnerability and exploit discovery, and tools such as Bettercap and John the Ripper during execution.
The agents continuously exchange outputs, allowing the system to verify an attack, advance to the next stage, or retry using a modified approach when execution fails.
In the evaluated implementation, researchers used ChatGPT 5.1 Thinking as the LLM. Every command generated, attack plan, and execution output was logged and made available to the user, enabling optional human oversight during testing.
According to Arxiv, the evaluation focused on IoTGoat, an intentionally vulnerable OpenWrt-based firmware environment that simulates common IoT security weaknesses.
The testbed consisted of isolated attacker, client, and target virtual machines, with Kali Linux hosting the framework and Ubuntu serving as the client system.
VEXAIoT addressed nine categories from the OWASP IoT Top 10 through ten scenarios, including recovering default passwords, creating a MiniUPnP backdoor, cross-site scripting, accessing developer backdoors, insecure update handling, DNS denial of service, extracting Personally Identifiable Information (PII) from databases, credential interception, log deletion, and remote code execution.
Attack Scenario Results Over 20 Trials
- Cross-Site Scripting (XSS), Developer Backdoor, Malicious Update:100% success
- Database PII Extraction, Log Deletion, Remote Code Execution (RCE): 100% success
- Man-in-the-Middle (MitM) Credential Interception:95% success
- Password Recovery:90% success
- MiniUPnP Backdoor and DNS Denial of Service: 80% success each
The vulnerability-detection agent completed reconnaissance and attack planning in all 200 trials. The attack-execution agent experienced 11 failures, attributed to five model refusals, five persistent command-syntax errors, and one hallucinated output.
This research demonstrates how agent-based AI can streamline several traditional stages of penetration testing, such as reconnaissance, vulnerability correlation, exploit selection, execution, validation, and retry logic, into an automated workflow.
The highest reliability was observed in attacks characterized by deterministic steps, clear validation conditions, or direct mappings to available scripts.
However, it is important to note that the results of this study should not be interpreted as evidence that an AI system can reliably compromise arbitrary real-world devices.
The testing was conducted in isolated, deliberately vulnerable environments, and the less successful outcomes in service-specific attacks indicate that command construction, model safety behaviors, and environmental variability are significant constraints.
For defenders, VEXAIoT underscores the need to eliminate default credentials, turn off unnecessary services, patch outdated components, secure update mechanisms, encrypt sensitive traffic, and centralize logs. Implementing these controls directly addresses the vulnerabilities the framework exploited during its testing scenarios on IoTGoat.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
 within controlled test environments.){kind=link}