From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs

Alsharif Abuadbba; Burak Hasircioglu; Chris Hicks; Diksha Goel; Kristen Moore; Piers Jennings; Vasilios Mavroudis

REVIEW 3 major objections 6 minor 1 cited by

From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLMs are not yet reliable enough to run cybersecurity red and blue team operations autonomously, and this paper argues for keeping humans in the loop.

desk verdict A solid, honest position paper mapping LLM strengths and limitations onto MITRE/NIST; the operational claim outruns the evidence, which the paper itself acknowledges. read the letter →

arxiv 2506.13434 v1 pith:MWGH75XI submitted 2025-06-16 cs.CR

Alsharif Abuadbba , Chris Hicks , Kristen Moore , Vasilios Mavroudis , Burak Hasircioglu , Diksha Goel , Piers Jennings This is my paper

classification cs.CR

keywords largelanguagemodelsredteamingblueMITREATT&CKNISTCybersecurityFrameworkhuman-in-the-loopdual-useriskLLMreliability

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This position paper argues that LLMs are not yet trustworthy enough to run cybersecurity red and blue team operations autonomously. Mapping LLM tasks onto the MITRE ATT&CK and NIST CSF frameworks, the authors show where the models add value—planning, drafting, summarizing, introductory pentesting—and where they break down in critical, context-heavy work. The breakdowns come from known model weaknesses: hallucinated facts, loss of context in long sessions, shallow multi-step reasoning, and extreme sensitivity to prompt wording. If the paper is right, organizations should treat LLMs as supervised assistants rather than autonomous agents, and should invest in benchmarks that test models in realistic operational environments rather than in capture-the-flag or synthetic settings.

What carries the argument

The analysis is organized around two standard frameworks used as a structured lens: the MITRE ATT&CK matrix for red team tactics and the NIST Cybersecurity Framework (CSF) 2.0 functions for blue team activities. The paper maps representative LLM capabilities onto these frameworks, then runs each of four technical limitations—context retention, hallucination, reasoning, and prompt/tuning sensitivity—through those mapped tasks to show where failures would be most damaging. This framework-mapping is the mechanism that turns scattered LLM weaknesses into an operational risk assessment.

What would settle it

Take a live, instrumented test network, run an LLM-based red team agent on the full kill chain of Table 1 tasks for N trials, and measure how often the agent (1) fails to recall its own earlier reconnaissance results, (2) recommends a non-existent exploit path, or (3) changes strategy when the same prompt is rephrased. High reliability across a large N would directly contradict the paper's fragility claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that while LLMs display fluency and versatility across a wide range of security tasks, they remain brittle in high-stakes, context-rich environments, with hallucinations, constrained context retention, reasoning deficiencies, and prompt sensitivity undermining their reliability in operational settings. The authors support this by surveying recent empirical evaluations of LLM-driven red teaming, analyzing each major limitation against concrete red and blue team activities, and cataloging risks of real-world integration such as dual-use proliferation, over- and under-reliance on automation, privacy exposure from proprietary APIs, and amplified hazards from agentic LLMs. Their conclusion is a set of governance and design recommendations centered on human-in-the-loop oversight, explainability, privacy-preserving deployment, and realistic benchmarking.

Load-bearing premise

The paper assumes that the LLM failures documented in laboratory studies and vendor incident reports carry over to real operational red and blue team deployments, with no longitudinal field data to confirm that these limits dominate production use.

Editorial extensions

If this is right

Organizations should design security workflows with human review points for any irreversible or high-impact LLM action, such as executing exploit code or altering system state.
LLM integration in blue teams should target language-heavy tasks like report drafting and threat-intelligence aggregation before action-oriented automation such as autonomous response or root cause analysis.
Realistic operational benchmarks and standardized testbeds, not capture-the-flag challenges, are needed to measure whether models can hold context and reason across full attack chains.
Agentic LLMs that chain tool calls without human review multiply the risks of hallucinations and context loss, and should be deployed with tool-access controls and fail-closed mechanisms.
Red and blue team purchases of LLM-based security products should be vetted against the documented reliability limits, especially for autonomous operation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the paper's fragility claim transfers to production, then the current wave of AI copilot security products may be overpromising autonomy, and procurement should demand evidence from high-fidelity evaluations rather than demos.
A testable extension would be running a standardized multi-stage attack simulation with several commercial and open models in a live environment, measuring how often the model drops earlier context, hallucinates a feasible-seeming step, or changes behavior on trivial prompt rephrasing.
The dual-use concern implies an asymmetric risk: defenders must be more cautious than attackers because a hallucinating defending agent can cause denial-of-service outcomes (e.g., re-encrypting already encrypted data), while a hallucinating attacking agent merely wastes effort.
The paper's recommendation to keep humans in the loop suggests a natural next research question: how much supervision bandwidth is actually needed, and can adaptive automation thresholds reduce human load without sacrificing reliability?

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this if you want a structured map of where LLMs currently help and hurt in red and blue teaming. The paper is a position piece, not a research result, but it is a competent one. Its best contribution is the explicit mapping of known LLM strengths and limitations onto MITRE ATT&CK and NIST CSF, with concrete examples in the tables. The authors are honest about the evidence: in §4.2.5 they concede that most security AI evaluations happen in controlled environments that miss the complexity of live networks. That admission is both a strength and the key weakness. The abstract's claim that LLMs 'undermine their reliability in operational settings' is a leap from lab benchmarks and a few incident reports. The weak form—LLMs need human oversight—is well supported. The strong form—autonomous agents are unsafe in real operations—is an extrapolation the paper does not test. The paper itself mostly stays hedged, but the abstract overstates the operational conclusion.

What the paper does well: the literature synthesis is accurate and the self-citations are used contextually, not to force conclusions. The blue team benefits are explicitly flagged as under-researched, which is the right call. The dual-use discussion, including the Scattered Spider example, is balanced and appropriately cites CrowdStrike's probabilistic attribution. The recommendations—human-in-the-loop, access tiers, real-world benchmarks, tool-access brokering for agents—are sensible and follow from the analysis.

Soft spots: the motivating numbers ($9.5 trillion cybercrime cost, Amazon's 'one billion threats a day') come from secondary sources and a WSJ interview, not primary measurements; that is a rigor gap. The NIST CSF mapping stays at a high level, so it is more useful for governance conversations than for deciding which specific tasks to trust. And there is no field or longitudinal data, so the paper's own recommendations for real-world evaluation remain a proposal, not a demonstration. None of this is fatal for a position paper, but it does cap the significance.

The stress-test's concern is on target: the paper's load-bearing gap is the lab-to-operations transfer, and the authors themselves point at it. The fix is straightforward: soften the abstract or make the call for a field deployment study more central.

Who should read this: security operations leads, policymakers, and researchers who want a concise, well-organized reference on LLM applications and risks in red/blue teaming. A serious referee can help by pressing the authors on scope and precision. I'd send this to review rather than desk reject. It is not a technical breakthrough, but it is a useful synthesis that will be cited for the framework mapping.

Referee Report

3 major / 6 minor

Summary. This position paper surveys the use of large language models (LLMs) in cybersecurity red and blue teaming, mapping LLM-assisted tasks onto the MITRE ATT&CK and NIST CSF frameworks. It argues that while LLMs offer efficiency gains in planning, execution support, documentation, and intelligence synthesis, they remain fragile in high-stakes, context-rich settings due to context-length limits, hallucinations, reasoning deficiencies, and prompt sensitivity. The paper identifies dual-use, over-reliance, under-reliance, privacy, and agentic-LLM risks, and concludes with recommendations for human-in-the-loop oversight, privacy-conscious deployment, guardrails for agentic systems, and real-world benchmarking.

Significance. The paper's main contribution is a structured synthesis of a fast-moving area, with a clear mapping of LLM capabilities and failure modes to established security frameworks. It usefully collects recent empirical results on LLM penetration testing, CTF performance, and adversarial exploitation, and it explicitly calls for realistic benchmarks—a need the field acknowledges. The recommendations are concrete and actionable. However, the paper introduces no primary experimental data, and its central fragility claim rests on lab-to-operations transfer that is flagged but not argued for. As a position paper, it is valuable as an agenda-setting synthesis, provided the evidence-to-conclusion gap is addressed.

major comments (3)

[Abstract; §4.2 and §4.2.5] The central claim that LLM limitations 'undermine their reliability in operational settings' is supported only by controlled-environment studies, CTF benchmarks, and anecdotal incident reports. §4.2.5 itself concedes that 'most security AI evaluations are conducted in controlled environments that fail to capture the complexity of real-world live networks.' The paper should either soften the claim (e.g., 'may undermine' or 'are likely to undermine') or provide an explicit argument for why lab findings transfer to live operations, such as identifying invariants that persist across settings. Without this, the strongest reading of the abstract (that LLMs are unsafe for autonomous operational use) is under-supported.
[§4.3.1 and §5.1] §4.3.1 correctly reports that CrowdStrike's 2024 Global Threat Report says Scattered Spider 'likely' used an LLM to generate PowerShell scripts, but §5.1 states the report 'shows adversaries already adopting LLMs' without the hedge. This shift from a single, hedged attribution to an established trend overstates the evidence for the dual-use risk narrative. Please either preserve the original hedging throughout or add corroborating sources (e.g., other threat reports or academic studies) before treating LLM misuse as a confirmed trend.
[§5.5] The paper rightly calls for 'real-world benchmarks' but does not specify what such benchmarks would measure or how they would differ from existing controlled evaluations. Since the absence of such benchmarks is used as a key limitation (in §4.2.5), the recommendation would be stronger if it sketched at least one concrete evaluation design (e.g., live-network sandboxes with realistic traffic, measurable operator outcomes, and failure-mode taxonomies). This would also help bridge the evidence gap identified in the abstract.

minor comments (6)

[§2] The motivating statistics (e.g., $9.5 trillion cybercrime cost, Amazon's 'nearly 1 billion cyber threats per day') are cited from a legal-analysis preprint and a WSJ report; the paper should note the provenance and provisional nature of these figures, since they are used to frame the entire threat landscape.
[§4.2.2] Typo: 'redential Access' should be 'Credential Access'.
[§5.4] Typo: 'auditibilty' should be 'auditability'.
[References [7]] The CVE reference is inconsistent: the text and title give CVE-2025-31491, but the entry reads 'CVE-2025-314910'.
[§4.2.3] The phrase 'Catch the Flag (CTF)' should be 'Capture the Flag (CTF)'.
[Introduction] Formatting: 'red Vs blue teaming' should be 'red vs. blue teaming', and several author names (e.g., 'V ASILIOS MA VROUDIS') have irregular spacing and capitalization.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the paper is a position survey whose claims rest on external literature and incident reports, not on self-referential derivations.

full rationale

This is a position paper that maps LLM applications onto MITRE ATT&CK and NIST CSF, summarizes documented technical limitations, and gives recommendations. It contains no fitted parameters, no equations, and no prediction derived from its own inputs. The central fragility claim (e.g., hallucinations, limited context retention, poor reasoning, prompt sensitivity) is supported by citations to external benchmarks, surveys, and vendor reports, including CrowdStrike's 2024 Global Threat Report for the Scattered Spider example. Two references include one of the authors (Wang et al. 2025 and Wu et al. 2024), but they are used as contextual support for adversarial LLM taxonomies and threat-modeling automation, not as the sole justification for any load-bearing conclusion. The authors themselves concede in Section 4.2.5 that most security AI evaluations are conducted in controlled environments, so the generalization from lab evidence to operational settings is a conditionality or evidence-strength concern, not a circularity concern. There is no step where an input is defined in terms of an output, no fitted value is renamed as a prediction, and no uniqueness theorem or ansatz is imported from the authors' own prior work to force a conclusion. Accordingly, the appropriate finding is no significant circularity with a score of 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no free parameters or invented entities. Its arguments rest on accepted background of LLM behavior and on secondary reports used to motivate urgency; these are listed as domain assumptions. No derivation or fitted quantity is present.

assumptions (5)

domain assumption The transformer architecture and autoregressive pretraining produce the LLM capabilities and limitations described in Section 3.1.
Background from cited works [28, 33, 40]; the paper does not verify these properties directly.
domain assumption The cybercrime cost estimate ($9.5 trillion in 2024, $10.5 trillion in 2025) from [24] is accurate.
Used to motivate urgency in Section 2; the source is a legal analysis preprint and not a primary measurement.
domain assumption Amazon faces nearly 1 billion cyber threats per day as reported in the Wall Street Journal [29].
Section 2; based on a single company's report, not independently verified.
domain assumption MITRE ATT&CK and NIST CSF are appropriate lenses for assessing LLM utility in red and blue teaming.
Section 3.2; the choice of frameworks is reasonable but not derived or justified with comparative analysis.
domain assumption The CrowdStrike 2024 report correctly attributes a Scattered Spider attack to LLM-generated PowerShell scripts.
Sections 4.3.1 and 5.1; external vendor attribution presented as evidence of dual-use adoption, but not independently verified.

how reviews work

0 comments

Cite this review

Pith. "Pith review of From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs." pith.science (2026). https://pith.science/paper/MWGH75XI

@misc{pith2026250613434,
  author       = {Pith},
  title        = {Pith review of: From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MWGH75XI}},
  note         = {Machine review of arXiv:2506.13434}
}

read the original abstract

Large Language Models (LLMs) are set to reshape cybersecurity by augmenting red and blue team operations. Red teams can exploit LLMs to plan attacks, craft phishing content, simulate adversaries, and generate exploit code. Conversely, blue teams may deploy them for threat intelligence synthesis, root cause analysis, and streamlined documentation. This dual capability introduces both transformative potential and serious risks. This position paper maps LLM applications across cybersecurity frameworks such as MITRE ATT&CK and the NIST Cybersecurity Framework (CSF), offering a structured view of their current utility and limitations. While LLMs demonstrate fluency and versatility across various tasks, they remain fragile in high-stakes, context-heavy environments. Key limitations include hallucinations, limited context retention, poor reasoning, and sensitivity to prompts, which undermine their reliability in operational settings. Moreover, real-world integration raises concerns around dual-use risks, adversarial misuse, and diminished human oversight. Malicious actors could exploit LLMs to automate reconnaissance, obscure attack vectors, and lower the technical threshold for executing sophisticated attacks. To ensure safer adoption, we recommend maintaining human-in-the-loop oversight, enhancing model explainability, integrating privacy-preserving mechanisms, and building systems robust to adversarial exploitation. As organizations increasingly adopt AI driven cybersecurity, a nuanced understanding of LLMs' risks and operational impacts is critical to securing their defensive value while mitigating unintended consequences.

Figures

Figures reproduced from arXiv: 2506.13434 by the authors.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit
cs.CR 2026-04 unverdicted novelty 6.5 of 10

Security practitioners use LLMs independently for low-risk productivity tasks while showing interest in enterprise platforms, but reliability, verification needs, and security risks limit broader autonomy.

Reference graph

Works this paper leans on

41 extracted references · 23 canonical work pages · cited by 1 Pith paper

[1]

Talor Abramovich, Meet Udeshi, Minghao Shao, Kilian Lieret, Haoran Xi, Kimberly Milner, Sofija Jancheska, John Yang, Carlos E Jimenez, Farshad Khorrami, et al. 2024. EnIGMA: Enhanced Interactive Generative Model Agent for CTF Challenges. arXiv preprint arXiv:2409.16165 (2024)

arXiv 2024
[2]

Bader Al-Sada, Alireza Sadighian, and Gabriele Oligeri. 2024. MITRE ATT&CK: State of the art and way forward. Comput. Surveys 57, 1 (2024), 1–37

work page 2024
[3]

Evan Anderson. 2023. Red teaming 101: What is red teaming? IBM (2023). https://www.ibm.com/think/topics/red-teaming Accessed: 2024-09-26

work page 2023
[4]

Yoshua Bengio, Sören Mindermann, Daniel Privitera, Tamay Besiroglu, Rishi Bommasani, Stephen Casper, Yejin Choi, Philip Fox, Ben Garfinkel, Danielle Goldfarb, et al. 2025. International AI Safety Report. arXiv preprint arXiv:2501.17805 (2025)

arXiv 2025
[5]

Sarah Brown, Joep Gommers, and Oscar Serrano. 2015. From Cyber Security Information Sharing to Threat Management. In Proceedings of the 2nd ACM Workshop on Information Sharing and Collaborative Security (WISCS ’15) . Association for Computing Machinery, 43–49. https: //doi.org/10.1145/2808128.2808133

work page arXiv 2015
[6]

CrowdStrike. 2024. 2024 Global Threat Report - Hiding in Plain Sight. (2024)

work page 2024
[7]

CVE-2025-314910

CVE-2025-31491 2025. CVE-2025-314910. Available from MITRE.. https://www.cve.org/CVERecord?id=CVE-2025-31491

work page 2025
[8]

Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024. {PentestGPT}: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. In33rd USENIX Security Symposium (USENIX Security 24). 847–864

work page 2024

Show all 41 references

[9]

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human...

2019
[10]

Zane Durante, Qiuyuan Huang, Naoki Wake, Ran Gong, Jae Sung Park, Bidipta Sarkar, Rohan Taori, Yusuke Noda, Demetri Terzopoulos, Yejin Choi, et al. 2024. Agent ai: Surveying the horizons of multimodal interaction. arXiv preprint arXiv:2401.03568 (2024)

2024 arXiv
[11]

enisa. 2022. Enisa Threat Landscape 2022. Europien Union Agency For Cybersecurity (2022). https://www.enisa.europa.eu/publications/enisa-threat- landscape-2022 Accessed: 2025-05-28

2022
[12]

Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. 2024. Llm agents can autonomously exploit one-day vulnerabilities. arXiv preprint arXiv:2404.08144 (2024)

2024 arXiv
[13]

Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. 2024. Llm agents can autonomously hack websites. arXiv preprint arXiv:2402.06664 (2024)

2024 arXiv
[14]

Andreas Happe and Jürgen Cito. 2025. Benchmarking Practices in LLM-driven Offensive Security: Testbeds, Metrics, and Experiment Design. arXiv preprint arXiv:2504.10112 (2025)

2025 arXiv
[15]

Stephen Hilt and Aliakbar Zahravi. [n. d.]. Red Team Tools in the Hands of Cybercriminals and Nation States. Trend Research ([n. d.]). https: //documents.trendmicro.com/images/TEx/articles/Research_Paper-Red-Team-Tools.pdf Accessed: 2025-06-01

2025
[16]

Cheng-Ping Hsieh, Simeng Sun, Samuel Kriman, Shantanu Acharya, Dima Rekesh, Fei Jia, and Boris Ginsburg. 2024. RULER: What’s the Real Context Size of Your Long-Context Language Models?. In First Conference on Language Modeling

2024
[17]

Jean Kaddour, Joshua Harris, Maximilian Mozes, Herbie Bradley, Roberta Raileanu, and Robert McHardy. 2023. Challenges and Applications of Large Language Models. arXiv:2307.10169 [cs.CL] https://arxiv.org/abs/2307.10169

2023 arXiv
[18]

Jared Kaplan, Sam McCandlish, Tom Henighan, et al. 2020. Scaling Laws for Neural Language Models. arXiv preprint arXiv:2001.08361 (2020)

2020 arXiv
[19]

Michael Kouremetis, Marissa Dotter, Alex Byrne, Dan Martin, Ethan Michalak, Gianpaolo Russo, Michael Threet, and Guido Zarrella. 2025. OCCULT: Evaluating Large Language Models for Offensive Cyber Operation Capabilities. arXiv preprint arXiv:2502.15797 (2025). 11 Alsharif Abuad...

2025 arXiv
[20]

Ivan Kovačević and Stjepan Groš. 2020. Red Teams-Pentesters, APTs, or Neither. In2020 43rd International Convention on Information, Communication and Electronic Technology (MIPRO). IEEE, 1242–1249

2020
[21]

Md Tahmid Rahman Laskar, Sawsan Alqahtani, M Saiful Bari, Mizanur Rahman, Mohammad Abdullah Matin Khan, Haidar Khan, Israt Jahan, Amran Bhuiyan, Chee Wei Tan, Md Rizwan Parvez, Enamul Hoque, Shafiq Joty, and Jimmy Huang. 2024. A Systematic Survey and Critical Review on Evaluat...

2024
[22]

Valérie Lavigne and Denis Gouin. 2014. Visual Analytics for cyber security and intelligence. The Journal of Defense Modeling and Simulation 11, 2 (2014), 175–199. https://doi.org/10.1177/1548512912464532

2014 doi
[23]

MITRE. 2024. ATT&CK Matrix for Enterprise. MITRE (2024). https://attack.mitre.org/ Accessed: 2024-12-18

2024
[24]

Dr Kamshad Mohsin. 2025. Cybercrime and Privacy in the Digital Age: Legal Frameworks, Emerging Challenges, and Future Trends. Emerging Challenges, and Future Trends (March 07, 2025) (2025)

2025
[25]

Stephen Moskal, Sam Laney, Erik Hemberg, and Una-May O’Reilly. 2023. LLMs killed the script kiddie: How agents supported by large language models change the landscape of network threat testing. arXiv 2023. arXiv preprint arXiv:2310.06936 (2023)

2023 arXiv
[26]

NIST. 2024. The NIST Cybersecurity Framework (CSF) 2.0. NIST (2024). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf NIST CSWP 29, Accessed: 2025-03-10

2024
[27]

NIST. 2024. NIST Trustworthy and Responsible Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST (2024)

2024
[28]

Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language Models Are Unsupervised Multitask Learners. OpenAI Blog, available at https://openai.com/blog/better-language-models/

2019
[29]

November 21, 2024

James Rundle. November 21, 2024. The AI Effect: Amazon Sees Nearly 1 Billion Cyber Threats a Day. Wall STreet Journal, available at https://www.wsj.com/articles/the-ai-effect-amazon-sees-nearly-1-billion-cyber-threats-a-day-15434edd

2024
[30]

Kumar Shashwat, Francis Hahn, Xinming Ou, Dmitry Goldgof, Lawrence Hall, Jay Ligatti, S Raj Rajgopalan, and Armin Ziaie Tabari. 2024. A Preliminary Study on Using Large Language Models in Software Pentesting. arXiv preprint arXiv:2401.17459 (2024)

2024 arXiv
[31]

Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. Reflexion: Language agents with verbal reinforcement learning. Advances in Neural Information Processing Systems 36 (2023), 8634–8652

2023
[32]

Faheem Ullah and Muhammad Ali Babar. 2019. Architectural Tactics for Big Data Cybersecurity Analytics Systems: A Review. Journal of Systems and Software 151 (2019), 81–118. https://doi.org/10.1016/j.jss.2019.01.051

2019 doi
[33]

Gomez, Łukasz Kaiser, and Illia Polosukhin

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention Is All You Need. In Advances in Neural Information Processing Systems . 5998–6008

2017
[34]

Nan Wang, Kane Walter, Yansong Gao, and Alsharif Abuadbba. 2025. Large Language Model Adversarial Landscape Through the Lens of Attack Objectives. arXiv preprint arXiv:2502.02960 (2025)

2025 arXiv
[35]

Tongze Wang, Xiaohui Xie, Lei Zhang, Chuyi Wang, Liang Zhang, and Yong Cui. 2024. ShieldGPT: An LLM-based framework for DDoS mitigation. In Proceedings of the 8th Asia-Pacific Workshop on Networking . 108–114

2024
[36]

White, Doug Burger, and Chi Wang

Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang (Eric) Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Ahmed Awadallah, Ryen W. White, Doug Burger, and Chi Wang. 2024. AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. InCOLM 2024

2024
[37]

Tingmin Wu, Shuiqiao Yang, Shigang Liu, David Nguyen, Seung Jang, and Alsharif Abuadbba. 2024. Threatmodeling-llm: Automating threat modeling using large language models for banking system. arXiv preprint arXiv:2411.17058 (2024)

2024 arXiv
[38]

John Yang, Akshara Prabhakar, Karthik Narasimhan, and Shunyu Yao. 2023. Intercode: Standardizing and benchmarking interactive coding with execution feedback. Advances in Neural Information Processing Systems 36 (2023), 23826–23854

2023
[39]

Andy K Zhang, Neil Perry, Riya Dulepet, Joey Ji, Celeste Menders, Justin W Lin, Eliot Jones, Gashon Hussein, Samantha Liu, Donovan Jasper, et al
[40]

Ziegler, Nisan Stiennon, et al

Daniel M. Ziegler, Nisan Stiennon, et al. 2019. Fine-Tuning Language Models from Human Preferences. arXiv preprint arXiv:1909.08593 (2019). 12

2019 arXiv
[2024]

arXiv preprint arXiv:2408.08926 (2024)

Cybench: A framework for evaluating cybersecurity capabilities and risks of language models. arXiv preprint arXiv:2408.08926 (2024)

2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Talor Abramovich, Meet Udeshi, Minghao Shao, Kilian Lieret, Haoran Xi, Kimberly Milner, Sofija Jancheska, John Yang, Carlos E Jimenez, Farshad Khorrami, et al. 2024. EnIGMA: Enhanced Interactive Generative Model Agent for CTF Challenges. arXiv preprint arXiv:2409.16165 (2024)

arXiv 2024

[2] [2]

Bader Al-Sada, Alireza Sadighian, and Gabriele Oligeri. 2024. MITRE ATT&CK: State of the art and way forward. Comput. Surveys 57, 1 (2024), 1–37

work page 2024

[3] [3]

Evan Anderson. 2023. Red teaming 101: What is red teaming? IBM (2023). https://www.ibm.com/think/topics/red-teaming Accessed: 2024-09-26

work page 2023

[4] [4]

Yoshua Bengio, Sören Mindermann, Daniel Privitera, Tamay Besiroglu, Rishi Bommasani, Stephen Casper, Yejin Choi, Philip Fox, Ben Garfinkel, Danielle Goldfarb, et al. 2025. International AI Safety Report. arXiv preprint arXiv:2501.17805 (2025)

arXiv 2025

[5] [5]

Sarah Brown, Joep Gommers, and Oscar Serrano. 2015. From Cyber Security Information Sharing to Threat Management. In Proceedings of the 2nd ACM Workshop on Information Sharing and Collaborative Security (WISCS ’15) . Association for Computing Machinery, 43–49. https: //doi.org/10.1145/2808128.2808133

work page arXiv 2015

[6] [6]

CrowdStrike. 2024. 2024 Global Threat Report - Hiding in Plain Sight. (2024)

work page 2024

[7] [7]

CVE-2025-314910

CVE-2025-31491 2025. CVE-2025-314910. Available from MITRE.. https://www.cve.org/CVERecord?id=CVE-2025-31491

work page 2025

[8] [8]

Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024. {PentestGPT}: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. In33rd USENIX Security Symposium (USENIX Security 24). 847–864

work page 2024