REVIEW 3 major objections 5 minor 36 references
Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models
T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read A small local language model can close an autonomous attack loop end to end, succeeding on 10.9% of tasks today.
desk verdict Honest, well-scoped exploratory study whose central feasibility claim is conditional on a missing controller-only ablation; the negative result is solid and worth citing. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying mechanism is an observe-decide-act loop in which a small language model sits at the reasoning stage and a hand-coded controller wraps it in guardrails. The controller parses reconnaissance output into ranked per-service records, sends the objective, evidence, prior actions, and observations to the SLM, validates the model's proposed command against scope rules, executes it in an isolated attacker container, converts the terminal output into an updated observation, and feeds it back for replanning until the goal is verified or the attempt budget is exhausted. This loop is the thing the paper claims is feasible: the model chooses and revises actions from evidence about a live environment, while the controller supplies structure, validation, and termination conditions.
What would settle it
Run the same ranked attack surfaces with a rule-based tool mapping and no language model; if that baseline reproduces the bind-shell and FTP successes, the feasibility claim reduces to scripted automation. A complementary observation is to run the loop against a target absent from public walkthroughs, where success on the same single-step services would indicate genuine reasoning rather than memorized procedure.
Extended reading notes
Core claim
The central discovery is that architectural feasibility holds today: a model small enough to run on commodity hardware, given structured observations and a tool interface, sustained the full observe-decide-act cycle without human input or cloud service. The agent succeeded on two attack surfaces that required a single inferential step between observation and result and failed on the other forty-nine service-level attempts across three runs, for a 10.91% completion rate. The authors read the consistency of that pattern as the informative result: parsing, ranking, validation, execution, and verification all worked, while failures clustered wherever a correct next step had to be inferred rather than read off the scan. The security-relevant finding is therefore the location of the bottleneck, in small-model reasoning rather than in the surrounding machinery.
Load-bearing premise
The load-bearing premise is that the small model, not the controller's hand-coded service ranking and command validation, is the active decision-maker in the demonstrated loop; because the controller places the bind shell first and blocks invalid commands, and no model-free control run was performed, the model's positive contribution is not isolated.
Editorial extensions
If this is right
- An attacker can now place the decision component of a remote-access trojan on the endpoint itself, removing the cloud dependency and the network detection opportunity that comes with it.
- Even a 10.9% success rate lowers the practical skill floor: a process that costs almost nothing to repeat can be run across thousands of hosts, so weak agents still raise the threat volume against less-monitored targets.
- The failure modes an agentic implant produces, such as repeated command families, dead-end loops, and tool-to-service mismatches, are visible in execution telemetry, so monitoring chains of tool invocations is a more promising defense than static signatures.
- Because the binding constraint is small-model reasoning rather than architecture, improvement in SLM quality is expected to narrow the gap between feasibility and operational reliability; the authors flag this as an expectation, not a measurement.
- The logged decision traces from the harness can double as a detection dataset and as forensic artifacts for reconstructing why an agent chose the commands it ran.
Reading between the lines
- Inference: If the same controller, without the language model, reproduces the two repeatable successes, the near-term capability is better described as scripted automation with an attached language model than as autonomous judgment, and defenses can be prioritized accordingly.
- Inference: A target not present in public write-ups would separate reasoning from recall; repeating the loop there is a low-cost test of whether the successes are inference or memorized procedure.
- Inference: The authors' proposed modular sub-agents and explicit memory of failed attempts are architectural fixes that could close the recovery gap before better base models arrive; if they work, the threat matures without waiting for SLM scaling.
- Inference: If reasoning improves as expected, audit trails of prompts, model outputs, tool calls, and validation decisions become the key forensic artifacts, making transparency a design requirement for AI-assisted security systems.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper defines an 'agentic RAT' as a remote-access trojan whose decision loop is driven by a locally deployed small language model, and reports an exploratory lab study of this concept. In a Docker-based, network-isolated environment, the authors connect an 8-billion-parameter Dolphin-family model to a controller that scans a Metasploitable2 target, presents ranked reconnaissance evidence to the model, validates model-selected commands, executes them over SSH, and feeds terminal output back into the loop. Over three runs, the agent completed 6 of 55 service-level tasks (10.91%), with consistent success only on the 1524/tcp bind shell and the vsftpd FTP service. The authors distinguish an 'architectural feasibility' claim (the loop can close on commodity hardware without cloud or operator) from an 'operational capability' claim (the agent is not yet a reliable attacker), arguing that the failures are due to current small-model reasoning limits rather than to the surrounding machinery. The paper also discusses defensive implications, limitations, and future work, and explicitly acknowledges the absence of a controller-only ablation.
Significance. If the architectural feasibility claim is accepted, the paper provides a concrete, reproducible demonstration that a locally hosted small model can be wired into a closed observe-decide-act loop against real vulnerable services, and it quantifies a deliberately strict success rate that bounds current operational capability. The negative result is the more robust part of the paper: the consistent 10.9% completion rate across three runs, the systematic failure on multi-step tasks, and the cheap visibility of repetitive failure loops are useful empirical data points for defenders. The authors are unusually careful in their limitations section, explicitly flagging the missing ablation, training-data contamination risk, single-target scope, and model-selection constraints. However, because the security significance is tied to the claim that the SLM, not the hand-coded controller, is the component that closes the loop and will improve, the missing controller-only ablation is a load-bearing gap rather than a peripheral caveat. The paper is a valuable exploratory study, but its central attribution claim needs additional experimental support before it can be accepted as established.
major comments (3)
- [§3.2 and §6 (No controller-only ablation)] The central claim in §5.1 that 'a model small enough to run on commodity hardware... sustained the full observe-decide-act cycle without human input' is not established for the SLM as the decision-maker. The controller hand-codes the service ranking (assigning the 1524/tcp bind shell the highest priority), validates commands by blocking scope violations, listener mode, unsupported flags, wrong targets, and service mismatches, and instructs the model to switch tool families after repeated failures. Section 6 concedes that a rule-based controller running the ranked attack surfaces top-down would plausibly reproduce both repeatable successes, and that the success figures are an upper bound on what the SLM adds. Because both successful services are exactly the cases where the scan evidence names a single direct action, the feasibility claim is currently supported only for the controller-plus-SLM assembly. I recommend running the controller-only ablation the authors identify as their first intended experiment, and, until it is run, rephrasing the §5.1 claim to describe what the assembly demonstrated rather than what the SLM alone contributed.
- [§6 (Training-data contamination)] The paper acknowledges that Metasploitable2 is a standard teaching target with abundant public walkthroughs, and that dolphin3-cyber-8b is a cyber-tuned model that has plausibly encountered this exact target during training. This weakens the stronger reading of the two repeatable successes as evidence that the model 'interpreted ranked reconnaissance evidence.' If the successful commands were memorized procedures rather than inferences over the supplied observations, then even the architectural feasibility claim is partly a claim about recall from training data. The authors are correct that this weakens the successes more than it excuses the failures, but the paper should either test on a target absent from public walkthroughs or explicitly limit the feasibility claim to 'reproducing known procedures for a familiar target.' As written, the §5.1 interpretation goes beyond what the data can distinguish.
- [§6 and §9 (Model-class extrapolation)] The conclusion extrapolates from dolphin3-cyber-8b to 'small models' as a class, arguing that the reasoning component is the bottleneck and that this is the component improving fastest. However, only one model family was tested, and Section 6 explicitly notes that the authors cannot separate limitations of small models in general from limitations of this particular model. The paper's central security-relevant prediction depends on this separation, but no scaling comparison or second-model replication is provided. I recommend either adding a second small-model comparison (even a single additional model available in LM Studio) or softening the class-level claims in §5.1 and §9 so that the conclusions are explicitly conditional on the Dolphin-family model tested.
minor comments (5)
- [§4.1 and Table 1] The text reports 55 service-level tasks and average success rate 10.91%, but Table 1 shows only per-run success rates, not task counts. Adding counts per run (e.g., '2/21', '2/17', '2/17') would make the aggregate arithmetic transparent and improve reproducibility.
- [§3.3] The 60/20/20 weighting of the evaluation score is admittedly not externally validated and is meaningful only within this study. That is acceptable, but the paper should avoid presenting the average score of 12.72 as a headline result; the task-level success counts are the more interpretable metric, and the score should remain a secondary diagnostic.
- [§5.2] The phrase 'Everything requiring more than one inferential step degraded' is too strong for a three-run, single-target study. A more precise statement would be 'every service requiring more than one inferential step failed in all three runs,' which is the actual evidence.
- [§5.3] The claim that 'monitoring focused on chains of tool invocations is more promising than static signatures' is presented as a suggestion, which is appropriate, but it would help to note explicitly that no defensive product or monitoring system was evaluated; the evidence is the controller's ability to detect repetition and blocked attempts in this specific prototype.
- [§4.1] The phrase 'after the parser and controller updates' implies earlier runs were excluded from the reported results. Please report how many runs were performed before the updates and what changes were made, so readers can assess whether the reported three runs are the result of iterative tuning.
Circularity Check
No significant circularity: the paper's claims are empirical measurements with disclosed attribution limits, not a derivation that reduces to its own inputs.
full rationale
This paper reports an empirical agentic-RAT testbed and contains no derivation chain of equations or fitted parameters. The central claims are (i) architectural feasibility and (ii) a 10.9% task-completion rate, both measured from execution logs. The hand-coded service ranking and command validator are experimental inputs, not quantities fitted to the outcome; the paper explicitly attributes prioritization to the controller and labels the success figures an upper bound on what the SLM adds. The missing controller-only ablation is a genuine internal-validity limitation, but the paper discloses it and does not present the results as proving the SLM alone caused the successes. Self-citations ([20], [21], [31]–[34]) appear in background and future-work predictions and are not load-bearing for the measured claims. No step is equivalent to its input by definition, so no circularity is present.
Assumptions & free parameters
free parameters (2)
- Evaluation score weights =
60% checklist, 20% efficiency, 20% reliability
- Service ranking priorities =
bind shell rank 100, FTP rank 80, other services lower or unranked
assumptions (4)
- domain assumption Metasploitable2 and its services are a valid proxy for real vulnerable hosts
- domain assumption The controller's interface faithfully represents the decision loop an implant would have
- domain assumption dolphin3-cyber-8b is representative of small language models generally
- domain assumption The model's outputs are genuine reasoning rather than memorized procedures from public Metasploitable2 walkthroughs
invented entities (1)
-
Agentic RAT (SLM-driven remote access trojan) as a malware class
Cite this review
Pith. "Pith review of Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models." pith.science (2026). https://pith.science/paper/5FJU5S24
@misc{pith2026260803009,
author = {Pith},
title = {Pith review of: Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/5FJU5S24}},
note = {Machine review of arXiv:2608.03009}
}
read the original abstract
Agentic artificial intelligence raises a new security concern: cyber threats that reason, act, and adapt locally without continuous human direction. We examine this threat through an Agentic Remote Access Trojan (agentic RAT): a Remote Access Trojan augmented with a locally deployed Small Language Model (SLM). The SLM interprets host and network observations, selects actions, recovers from failed steps, and reduces reliance on an external operator. We implement the concept in a controlled, network-isolated lab built from Kali Linux, a Metasploitable2 target, LM Studio, and a local 8-billion-parameter Dolphin-family model. We then test whether a model this small can support autonomous cyber decision-making. This is architecturally feasible today. On commodity hardware, with no cloud service and no operator in the loop, the SLM closed the full observe-decide-act cycle: it interpreted ranked reconnaissance evidence supplied by the controller, selected actions, and obtained verified root-shell access on real vulnerable services. However, it is not yet operationally reliable. The same model hallucinated commands, misread output, and recovered from failure inconsistently, completing 10.9% of a deliberately strict checklist. That gap reflects the limits of today's small models, not a ceiling on the concept. As SLMs improve, agentic endpoint systems may become more practical, more autonomous, and harder to detect, straining existing monitoring, containment, and policy-enforcement mechanisms. Real-world incidents in 2025-2026 already show AI-driven intrusions moving from concept toward practice. That makes the local, self-contained variant we study a plausible near-term direction, not a hypothetical one.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
Botnet Detection by Monitoring Similar Communication Patterns
Zeidanloo, H.R., Manaf, A.B.A.: Botnet Detection by Monitoring Similar Commu- nication Patterns. arXiv preprint arXiv:1004.1232 (2010)
work page Pith review arXiv 2010
-
[2]
Exploit Kits: The production line of the Cybercrime Economy
Hopkins, M., Dehghantanha, A.: Exploit Kits: The Production Line of the Cyber- crime Economy. arXiv preprint arXiv:1707.04714 (2017)
work page Pith review arXiv 2017
-
[3]
arXiv preprint arXiv:2210.03629 (2022)
Yao, S., Zhao, J., Yu, D., et al.: ReAct: Synergizing Reasoning and Acting in Language Models. arXiv preprint arXiv:2210.03629 (2022)
arXiv 2022
-
[4]
Sherwood, M., Chan, M., Ikonomidis, M., et al.: On-Device Small Language Models with Multimodality, RAG, and Function Calling. Google Developers Blog (2025). https://developers.googleblog.com/google-ai-edge-small-language-model s-multimodality-rag-function-calling/
work page 2025
-
[5]
arXiv preprint arXiv:2411.09944 (2024)
Pham, T.M., Nguyen, P.T., Yoon, S., et al.: SlimLM: An Efficient Small Lan- guage Model for On-Device Document Assistance. arXiv preprint arXiv:2411.09944 (2024)
arXiv 2024
-
[6]
MITRE: MITRE ATT&CK.https://attack.mitre.org/(accessed 2026)
work page 2026
-
[7]
Learning Explainable Representations of Malware Behavior
Prasse, P., Brabec, J., Kohout, J., et al.: Learning Explainable Representations of Malware Behavior. arXiv preprint arXiv:2106.12328 (2021)
work page Pith review arXiv 2021
-
[8]
arXiv preprint arXiv:2402.02716 (2024)
Huang, X., Liu, W., Chen, X., et al.: Understanding the Planning of LLM Agents: A Survey. arXiv preprint arXiv:2402.02716 (2024)
arXiv 2024
Show all 36 references
-
[9]
arXiv preprint arXiv:2604.24636 (2026)
Oliveira, W.: Less Is More: Engineering Challenges of On-Device Small Language Model Integration in a Mobile Application. arXiv preprint arXiv:2604.24636 (2026)
2026 arXiv
-
[10]
arXiv preprint arXiv:2303.11366 (2023)
Shinn, N., Cassano, F., Berman, E., et al.: Reflexion: Language Agents with Verbal Reinforcement Learning. arXiv preprint arXiv:2303.11366 (2023)
2023 arXiv
-
[11]
arXiv preprint arXiv:2602.19555 (2026)
Jiang, X., Yang, S., Yang, W., et al.: Agentic AI as a Cybersecurity Attack Sur- face: Threats, Exploits, and Defenses in Runtime Supply Chains. arXiv preprint arXiv:2602.19555 (2026)
2026 arXiv
-
[12]
arXiv preprint arXiv:2603.30016 (2026)
Xiang, C., Zagieboylo, D., Ghosh, S., et al.: Architecting Secure AI Agents: Per- spectives on System-Level Defenses Against Indirect Prompt Injection Attacks. arXiv preprint arXiv:2603.30016 (2026)
2026
-
[13]
In: Proceedings of the 31st ACM Joint European Software Engi- neering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), pp
Happe, A., Cito, J.: Getting pwn’d by AI: Penetration Testing with Large Lan- guage Models. In: Proceedings of the 31st ACM Joint European Software Engi- neering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), pp. 2082–2086 (2023)
2023
-
[14]
arXiv preprint arXiv:2308.06782 (2023)
Deng, G., Liu, Y., Mayoral-Vilches, V., et al.: PentestGPT: An LLM-empowered Automatic Penetration Testing Tool. arXiv preprint arXiv:2308.06782 (2023)
2023 arXiv
-
[15]
arXiv preprint arXiv:2403.01038 (2024)
Xu, J., Stokes, J.W., McDonald, G., et al.: AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks. arXiv preprint arXiv:2403.01038 (2024)
2024 arXiv
-
[16]
arXiv preprint arXiv:2408.08926 (2024)
Zhang, A.K., Perry, N., Dulepet, R., Ji, J., Menders, C., Lin, J.W., et al.: Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models. arXiv preprint arXiv:2408.08926 (2024)
2024 arXiv
-
[17]
arXiv preprint arXiv:2409.11276 (2024)
Rigaki, M., Catania, C., Garcia, S.: Hackphyr: A Local Fine-Tuned LLM Agent for Network Security Environments. arXiv preprint arXiv:2409.11276 (2024)
2024 arXiv
-
[18]
arXiv preprint arXiv:2607.02605 (2026)
He, Z., Dong, J., Li, Z., et al.: A Survey of LLM-Driven Penetration Testing: Taxonomy, Co-Evolution, and Open Challenges. arXiv preprint arXiv:2607.02605 (2026)
2026 arXiv
-
[19]
arXiv preprint arXiv:2302.04761 (2023) 18 Y
Schick, T., Dwivedi-Yu, J., Dessì, R., Raileanu, R., Lomeli, M., Zettlemoyer, L., Cancedda, N., Scialom, T.: Toolformer: Language Models Can Teach Themselves to Use Tools. arXiv preprint arXiv:2302.04761 (2023) 18 Y. You et al
2023 arXiv
-
[20]
In: Plattner, H., Meinel, C., Leifer, L
Sadler, J., Shluzas, L.A., Blikstein, P., Srivastava, S.: Can Anyone Make a Smart Device? Evaluating the Usability of a Prototyping Toolkit for Creative Computing. In: Plattner, H., Meinel, C., Leifer, L. (eds.) Design Thinking Research, pp. 147–
-
[21]
In: Proceedings of the Ninth International Conference on Tangible, Embedded, and Embodied Interaction (TEI ’15), pp
Sadler, J., Durfee, K., Shluzas, L., Blikstein, P.: Bloctopus: A Novice Modular Sensor System for Playful Prototyping. In: Proceedings of the Ninth International Conference on Tangible, Embedded, and Embodied Interaction (TEI ’15), pp. 347–
-
[22]
ESET WeLiveSecurity (2025).https://www.welivesecurity.c om/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-res earch/
Cherepanov, A., Strýček, P.: First Known AI-Powered Ransomware Uncovered by ESET Research. ESET WeLiveSecurity (2025).https://www.welivesecurity.c om/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-res earch/
2025
-
[23]
arXiv preprint arXiv:2508.20444 (2025)
Raz, M., Udeshi, M., Charan, P.V.S., et al.: Ransomware 3.0: Self-Composing and LLM-Orchestrated. arXiv preprint arXiv:2508.20444 (2025)
2025 arXiv
-
[24]
Google Cloud Threat Intelligence (2025).https://clou d.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-a i-tools
Google Threat Intelligence Group: GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Google Cloud Threat Intelligence (2025).https://clou d.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-a i-tools
2025
-
[25]
Anthropic (2025).https://www.anthropic.com/news/disrupting-AI-esp ionage
Anthropic: Disrupting the First Reported AI-Orchestrated Cyber Espionage Cam- paign. Anthropic (2025).https://www.anthropic.com/news/disrupting-AI-esp ionage
2025
-
[26]
Hugging Face Blog (2026)
Hugging Face: Security Incident Disclosure, July 2026. Hugging Face Blog (2026). https://huggingface.co/blog/security-incident-july-2026
2026
-
[27]
arXiv preprint arXiv:2506.02153 (2025)
Belcak, P., Heinrich, G., Diao, S., et al.: Small Language Models Are the Future of Agentic AI. arXiv preprint arXiv:2506.02153 (2025)
2025 arXiv
-
[28]
arXiv preprint arXiv:2402.06664 (2024)
Fang, R., Bindu, R., Gupta, A., et al.: LLM Agents Can Autonomously Hack Websites. arXiv preprint arXiv:2402.06664 (2024)
2024 arXiv
-
[29]
arXiv preprint arXiv:2404.08144 (2024)
Fang, R., Bindu, R., Gupta, A., Kang, D.: LLM Agents Can Autonomously Exploit One-day Vulnerabilities. arXiv preprint arXiv:2404.08144 (2024)
2024 arXiv
-
[30]
arXiv preprint arXiv:2408.01605 (2024)
Wan, S., Nikolaidis, C., Song, D., et al.: CyberSecEval 3: Evaluating Cybersecurity Risks and Capabilities in Large Language Models. arXiv preprint arXiv:2408.01605 (2024)
2024 arXiv
-
[31]
International Journal of Design Creativity and Innovation 5(3–4), 168–184 (2017).https: //doi.org/10.1080/21650349.2015.1136796
Sadler, J., Shluzas, L., Blikstein, P.: Building Blocks in Creative Computing: Modularity Increases the Probability of Prototyping Novel Ideas. International Journal of Design Creativity and Innovation 5(3–4), 168–184 (2017).https: //doi.org/10.1080/21650349.2015.1136796
2017
-
[32]
In: Plattner, H., Meinel, C., Leifer, L
Sadler, J., Leifer, L.: TeamSense: Prototyping Modular Electronics Sensor Systems for Team Biometrics. In: Plattner, H., Meinel, C., Leifer, L. (eds.) Design Thinking Research, pp. 87–100. Springer, Cham (2015).https://doi.org/10.1007/978-3 -319-06823-7_7
2015 doi
-
[33]
IEEE Internet of Things Journal 2(6), 479–489 (2015).https://doi.org/10.1109/JIOT.2015.2444419
Graham, D., Simmons, G., Nguyen, D.T., Zhou, G.: A Software-Based Sonar Rang- ing Sensor for Smart Phones. IEEE Internet of Things Journal 2(6), 479–489 (2015).https://doi.org/10.1109/JIOT.2015.2444419
2015
-
[34]
Sadler, J.A.: The Anatomy of Creative Computing: Enabling Novices to Proto- type Smart Devices. Ph.D. dissertation, Department of Mechanical Engineering, Stanford University (2016).https://purl.stanford.edu/sj964qg3050
2016
-
[160]
Springer, Cham (2016).https://doi.org/10.1007/978-3-319-40382-3_10
2016 doi
-
[354]
ACM (2015).https://doi.org/10.1145/2677199.2680581
2015
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.