LLM Agents can Autonomously Exploit One-day Vulnerabilities (2404.08144v2)

Abstract: LLMs have becoming increasingly powerful, both in their benign and malicious uses. With the increase in capabilities, researchers have been increasingly interested in their ability to exploit cybersecurity vulnerabilities. In particular, recent work has conducted preliminary studies on the ability of LLM agents to autonomously hack websites. However, these studies are limited to simple vulnerabilities. In this work, we show that LLM agents can autonomously exploit one-day vulnerabilities in real-world systems. To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the CVE description. When given the CVE description, GPT-4 is capable of exploiting 87% of these vulnerabilities compared to 0% for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and Metasploit). Fortunately, our GPT-4 agent requires the CVE description for high performance: without the description, GPT-4 can exploit only 7% of the vulnerabilities. Our findings raise questions around the widespread deployment of highly capable LLM agents.

• The paper shows GPT-4 autonomously exploits 87% of one-day vulnerabilities when provided with CVE descriptions, outperforming GPT-3.5 and open-source models.
• The paper details the use of a ReAct agent framework to enable automated tool navigation and terminal interactions in exploiting cybersecurity flaws.
• The paper highlights cost efficiency, estimating an $8.80 expenditure per exploit compared to $25 for 30 minutes of human labor.

The paper you referred to, "LLM Agents can Autonomously Exploit One-day Vulnerabilities" by Richard Fang et al., investigates the capability of LLM agents to autonomously exploit cybersecurity vulnerabilities, particularly one-day vulnerabilities in real-world systems. Here's a detailed synthesis of the paper:

Abstract and Objectives

The authors explore the potential of LLM agents, with a focus on GPT-4, to exploit one-day vulnerabilities, which are vulnerabilities that have been disclosed but not yet patched. The paper collected a dataset of 15 one-day vulnerabilities, aiming to test the hypothesis that LLMs, particularly GPT-4, can autonomously exploit these real-world vulnerabilities at a significant success rate.

Key Findings

1. Exploitation Success: GPT-4 was able to exploit 87% of the tested one-day vulnerabilities when provided with the CVE description. In contrast, other models like GPT-3.5 and several open-source LLMs achieved a 0% success rate, as did open-source vulnerability scanners such as ZAP and Metasploit.
2. Importance of CVE Descriptions: The presence of CVE descriptions is critical for success. Without them, GPT-4's ability to exploit vulnerabilities drops significantly to 7%, highlighting that identifying vulnerabilities is more challenging than exploiting known ones.
3. Capabilities of LLM Agents: The paper demonstrates that LLM agents can function autonomously, using toolsets to navigate and interact with environments to exploit vulnerabilities. The paper confirms the capability of LLMs to engage in complex actions required for non-trivial cybersecurity tasks.
4. Scalability and Cost Efficiency: Using an LLM like GPT-4 for such tasks is cheaper than employing human cybersecurity experts. The paper estimates the cost of using GPT-4 for exploiting each vulnerability at approximately $8.80, compared to$25 for half an hour of human labor.

Methodology

• Dataset Creation: The authors curated a benchmark of 15 real-world one-day vulnerabilities from open sources, focusing on those that could be reproduced in a sandboxed environment.
• Agent Framework: They implemented the ReAct agent framework and provided tools that LLMs need, such as web browsing capabilities, a terminal interface, and a code interpreter.
• Evaluation Protocol: The evaluation involved measuring the success rate (pass at 5 and pass at 1) and cost efficiency of using GPT-4 to exploit these vulnerabilities.

Discussion and Implications

The findings of this paper suggest that while GPT-4 exhibits strong capabilities in exploiting known vulnerabilities, its capacity to discover new ones autonomously remains limited. This differentiation is crucial in understanding the role of LLM agents in cybersecurity, highlighting their potential value in automating defensive measures rather than solely offensive actions.

Ethical Considerations

The paper discusses the moral implications of using LLMs for cybersecurity, emphasizing that although these technologies can be used for malicious purposes, they also hold significant potential for automating threat detection and improving security measures.

Conclusion

The research underscores the capability of GPT-4 in specific exploitative tasks within cybersecurity, suggesting a need for careful management of such tools to prevent misuse while leveraging their strengths in enhancing cybersecurity defenses.

This paper highlights the cutting-edge potential and limitations of LLMs in cybersecurity scenarios, providing a critical evaluation of GPT-4's application in real-world vulnerability exploitation.