Pith. sign in

REVIEW 3 major objections 6 minor 2 cited by

Ransomware 3.0: Self-Composing and LLM-Orchestrated

T0 review · 3 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An LLM can act as the sole decision-maker in a ransomware campaign, completing reconnaissance, payload selection and execution, and personalized extortion without human intervention.

desk verdict Solid LLM-orchestrated ransomware prototype, but the personalized-extortion claim is not supported by their own refusal data. read the letter →

arxiv 2508.20444 v1 pith:5JFSWJKO submitted 2025-08-28 cs.CR

Md Raz , Meet Udeshi , P.V. Sai Charan , Prashanth Krishnamurthy , Farshad Khorrami , Ramesh Karri This is my paper
classification cs.CR
keywords LLM-orchestratedransomwareclosed-loopattackchainpolymorphicpayloadgenerationprompt-basedmalwareautonomousextortionopen-weightLLMside-channelanalysisthreatmodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces and demonstrates Ransomware 3.0, a threat model in which a large language model orchestrates the entire ransomware lifecycle—reconnaissance, choosing which files matter, selecting and executing a payload, and writing a personalized extortion note—with no human in the loop. The prototype ships as a binary containing only natural-language prompts; every malicious script is synthesized by an open-weight LLM at runtime, so each run produces polymorphic code that adapts to the environment. The authors evaluate it on personal-computer, enterprise-server, and embedded-controller setups with two open-weight models, reporting near-perfect reconnaissance, average sensitive-file identification accuracy of 63–69%, high payload execution fidelity, and a coherent ransom note in every run. The point is to show that a capable and inexpensive LLM lowers the barrier to targeted ransomware and shifts the detection surface away from classic signatures, so defenders must look at sensitive-file access and outbound LLM traffic.

What carries the argument

The load-bearing mechanism is the closed-loop orchestrator binary plus the LLM backend. The binary is written in Go and packages an embedded Lua interpreter, an OpenAI-compatible HTTP transport, public keys for asymmetric encryption, and four phase-segregated prompt sets: Reconnaissance, Leverage, Launch, and Notify. The LLM sees only one decontextualized task at a time—a coding, validation, or analysis task—so it never perceives the full attack. Coding tasks produce Lua scripts executed in memory; validator tasks inspect logs and return corrective feedback; analysis tasks rank files, choose payloads, and compose the note. Because code is generated fresh per run, identical prompts yield diff

What would settle it

Run the same orchestrator with an LLM endpoint that returns a policy refusal for every extract and destroy request without retry, on the same three environments. If an end-to-end campaign still completes, the closed-loop claim is supported; if the pipeline stalls before launching a payload, the claim depends on alignment behavior that can be switched off.

Watch

Extended reading notes

Core claim

The central discovery is that a closed-loop ransomware campaign can be run by an LLM alone. The orchestrator never contains malicious code; it embeds phase-specific prompts (scan, target, extract, decide, encrypt/exfiltrate/destroy, notify) and uses an embedded Lua interpreter to execute code the LLM generates at runtime. In 30 runs across three environments, both open-weight models completed the full pipeline: near-perfect file enumeration, correct per-environment payload choice (exfiltrate on a personal computer, encrypt on a company server, destroy on an embedded controller), working payload code, and personalized extortion notes. The paper's own data also show the main obstacle: the larg

Load-bearing premise

The whole chain depends on the victim machine being able to reach an LLM service and on that LLM being willing to answer ordinary-sounding coding prompts; block that access or make the model refuse and the closed loop stops.

Editorial extensions

If this is right

  • A capable adversary no longer needs a malware-engineering team: a commodity server running an open-weight model can launch a targeted, personalized campaign, shifting ransomware economics toward volume.
  • Classic ransomware signatures—bulk disk writes, CPU/HPC spikes, high network throughput—will not flag this class; the case study shows a low, flat side-channel profile with network traffic below 30 KB/s.
  • Effective defenses must move to sensitive-file access monitoring, decoy files planted to trigger during reconnaissance, and strict control and inspection of outbound LLM API traffic.
  • Payload polymorphism is natural: with identical prompts, key schedules and byte conversions differ run to run, so signature-based blocklists of generated code will not generalize.
  • Even when the LLM refuses to extract file contents (68–86% of requests for the larger model), the campaign still proceeds to encrypt or destroy on the files already identified, so refusal alone is not a stop.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The decontextualized-task prompt pattern is likely the reusable core of this attack class: a defender could look for sequences of file enumeration → sensitive-file selection → code-generation requests to a single LLM endpoint, which the paper does not explicitly propose as a detection signature.
  • A stronger-aligned model or API-side filtering of file-reading prompts could collapse the closed loop, since the paper's own refusal data show extraction is the weakest step; this suggests a direct evaluation of campaign completion under progressively stricter refusal and no-retry policies.
  • The same Go+Lua orchestrator architecture could be repurposed with different prompt sets for other operator-less malicious workflows, such as credential harvesting or sabotage, making the ransomware demonstration one instance of a broader LLM-as-operator threat class.
  • The side-channel results imply that anomaly detectors should be trained on sensitive-file open/read patterns rather than on write bursts; a testable check is whether a detector trained on the paper's telemetry flags the encrypt phase while missing the reconnaissance phase.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces Ransomware 3.0, a proof-of-concept orchestrator that delegates the entire ransomware lifecycle to an open-weight LLM. The binary carries natural-language prompts and an embedded Lua interpreter; at runtime it queries the LLM to generate code for filesystem scanning, sensitive-file identification and extraction, payload selection and execution, and ransom-note generation. The authors evaluate two GPT-OSS models across 10 runs each on a Windows PC, an Ubuntu company server, and a Raspberry Pi embedded controller, reporting per-phase success rates, token/iteration counts, and one side-channel case study in the SaMOSA sandbox. They claim this is the first fully closed-loop LLM-orchestrated ransomware with targeted payloads and personalized extortion tactics, and that it exhibits a minimal behavioral footprint.

Significance. If substantiated, the work is a timely and valuable contribution to AI security and threat modeling. It moves beyond isolated payload generation to a multi-phase autonomous attack pipeline and provides a phase-centric evaluation that is more granular than much prior LLM-malware work. The authors are transparent about policy refusals, code-generation errors (e.g., GPT-20B implementing correct SPECK in only 1/8 successful encryption runs), and the controlled sandbox setting. The task/artifact decomposition, use of two model sizes across three environments, and explicit phase metrics are concrete strengths. The main risk is that the headline claims—personalized extortion and a low detectable footprint—are broader than the reported evidence.

major comments (3)
  1. [§6.1, Table 2, §6.3, Appendix A.3] The headline claim of 'personalized extortion tactics' is not supported by the reported measurements. The notify task consumes target_file_info.log produced by the extract task; §6.3 explicitly states that when extract fails, 'the note is not personalized.' For GPT-120B, extract succeeds in only 20% (PC), 10% (company server), and 40% (embedded controller) of runs (Table 2), with policy refusals on 68–86% of extract requests (Appendix A.3, Table 4). Yet §6.1 states that 'both models consistently produced personalized ransom notes.' This is internally inconsistent. GPT-20B extracts more often, but has lower target accuracy and correct SPECK encryption in only 1/8 successful runs, so neither model reliably delivers the full combination of targeted payloads and personalization. Please either temper the central claim to 'personalized notes when extraction succeeds,' or provide per-run joint
  2. [§6.3, §7.2] The conclusion that Ransomware 3.0 has a 'minimal' or 'lightweight' footprint and 'shifts the detection surface' rests on a single SaMOSA case study. In that run, extract fails (so no exfiltration occurs), only nine files are encrypted, and the authors themselves note that system-call traces miss write calls despite in-place file overwrites. The claim that HPC and disk activity are low cannot be generalized from one run, and the spike at t=31s is dismissed as 'spurious' without a baseline or replication. To support RQ3, the paper needs multiple runs including successful extract/exfiltrate executions, a comparison against a benign baseline and a conventional ransomware sample, and a quantitative definition of 'low footprint.' As written, the behavioral analysis is anecdotal.
  3. [§5.5, §6.2, Table 3] The quantitative comparisons are based on only 10 runs per environment. Percentages such as 78% vs 83% and 72% vs 78% in Table 3(b) are presented as consistent model differences, but with n=10 the sampling uncertainty is large (e.g., a 50% rate has a 95% confidence interval of roughly ±25 percentage points). The paper should report raw counts and confidence intervals, and avoid phrases like 'consistently outperforms' for differences that may be within noise. This does not invalidate the qualitative feasibility demonstration, but the quantitative strength of the decision-quality claims should be calibrated.
minor comments (6)
  1. [Figure 1, Table 2] The labels in Figure 1 ('encr.lua', 'ANTI-ANALYSIS', 'SEC BYPASS') are cryptic; consider matching them to the task names used in the text. Table 2's column alignment is also hard to parse, particularly for the Notify phase.
  2. [Appendix A.3] The sentence 'we observe some policy refusals, but success rate remains high' appears immediately after reporting 68–86% refusal on the extract task. This is misleading and should be rephrased to distinguish extract (low success) from destroy/note (higher eventual compliance).
  3. [§7.3] The cost estimate of $0.70 per run uses GPT-5 API rates, while the experiments use open-weight models served via Ollama. This is an extrapolation, not a measurement; label it as such and note that commercial API access may be blocked by provider policy.
  4. [Figure 8] The text correctly warns that the two models ran on different hardware and their absolute run times are not comparable, but the figure plots time on a common axis. Consider separate panels or normalized time values to avoid inviting invalid cross-model comparisons.
  5. [§4, 'Jailbreaking'] The phrase 'without any jailbreak techniques' should be clarified: task decomposition and the automated follow-up prompt after a refusal (Appendix A.3) are a form of iterative prompt manipulation. It is not classic jailbreaking, but it is part of the attack's prompt-engineering surface and should be described as such.
  6. [Appendix A.2 and A.3] Minor typos: 'entirity' in the destroy prompt, 'sucessful' in the A.3 snippet; also the GPT-20B ransom note says files were 'encrypted' while the selected payload for a personal computer is exfiltration. The note's claims may be inconsistent with the executed payload.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an empirical construction/evaluation with no fitted-parameter or definitional loop; same-group citations are non-load-bearing.

full rationale

The paper does not contain a derivation chain that reduces to its own inputs. The central claim is empirical: an LLM-orchestrated binary can autonomously run reconnaissance, payload selection/execution, and extortion-note generation. Success is measured against independently seeded ground-truth file sets (10 sensitive files per run, Section 5.5, Table 1) and against external correctness criteria such as SPECK-128 reference behavior (Section 6.2). No parameter is fitted to the reported outcomes, no 'prediction' is a renamed fit, and no target quantity is defined in terms of the system's own outputs. The only overlapping-author citations are background material (e.g., [7]) and the SaMOSA sandbox [40] used as an instrumentation tool for the case study; SaMOSA provides side-channel telemetry but does not determine the success rates or the feasibility claim, so it is not load-bearing. The paper also explicitly reports the GPT-120B extract-task refusals and states that when extraction fails 'the note is not personalized' (Section 6.3, Appendix A.3). That is an evidentiary weakness in the 'personalized extortion' claim, not a circularity: the claim is not definitionally guaranteed by the implementation. Hence, under the hard rules, no circular step can be exhibited, and the honest finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No fitted parameters or invented entities. The paper relies on standard, stated threat-model assumptions about the victim environment and LLM behavior. The fragility of these assumptions is partially demonstrated by the paper's own refusal and error rates.

assumptions (3)
  • domain assumption The victim machine is infected and has unrestricted outbound connectivity to an LLM endpoint
    Stated in Section 3, Assumptions. The entire attack depends on the orchestrator reaching an LLM API.
  • domain assumption The LLM will comply with decontextualized, legitimate-looking prompts without jailbreaks
    Section 4 (Jailbreaking) explains the prompts are phrased as legitimate requests. The paper's own results (Appendix A.3) show 68-86% refusal rates for GPT-120B on the extract task, so this assumption is fragile.
  • domain assumption All cryptographic primitives invoked by generated payloads are correct implementations
    Section 3 Assumptions. The paper later shows GPT-20B often produces incorrect SPECK implementations, so this assumption is knowingly false for smaller models.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Ransomware 3.0: Self-Composing and LLM-Orchestrated." pith.science (2026). https://pith.science/paper/5JFSWJKO

@misc{pith2026250820444,
  author       = {Pith},
  title        = {Pith review of: Ransomware 3.0: Self-Composing and LLM-Orchestrated},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5JFSWJKO}},
  note         = {Machine review of arXiv:2508.20444}
}
read the original abstract

Using automated reasoning, code synthesis, and contextual decision-making, we introduce a new threat that exploits large language models (LLMs) to autonomously plan, adapt, and execute the ransomware attack lifecycle. Ransomware 3.0 represents the first threat model and research prototype of LLM-orchestrated ransomware. Unlike conventional malware, the prototype only requires natural language prompts embedded in the binary; malicious code is synthesized dynamically by the LLM at runtime, yielding polymorphic variants that adapt to the execution environment. The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement. We evaluate this threat across personal, enterprise, and embedded environments using a phase-centric methodology that measures quantitative fidelity and qualitative coherence in each attack phase. We show that open source LLMs can generate functional ransomware components and sustain closed-loop execution across diverse environments. Finally, we present behavioral signals and multi-level telemetry of Ransomware 3.0 through a case study to motivate future development of better defenses and policy enforcements to address novel AI-enabled ransomware attacks.

Figures

Figures reproduced from arXiv: 2508.20444 by the authors.

Figure 1
Figure 1. Ransomware 1.0/2.0 (left) vs. Ransomware 3.0 (Self [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. System overview of Ransomware 3.0 including core modules and natural language prompt sets. The HTTP transport [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Feedback flow diagram outlining output and artifact [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Remote server topology and orchestrator network [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Comparison of input and output tokens required by [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: Comparison of average iterations and relative time [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Side channels captured using the SaMOSA sandbox for the company server. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    A commercial LLM can cheaply produce large numbers of structurally diverse yet behaviorally equivalent malware payloads using functional prompts or history-augmented prompts.

  2. The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    A single commercial LLM can cheaply generate large populations of behaviorally equivalent yet structurally diverse malware payloads.

Reference graph

Works this paper leans on

58 extracted references · 50 canonical work pages · cited by 1 Pith paper

  1. [1]

    Jimenez, Farshad Khor- rami, Prashanth Krishnamurthy, Brendan Dolan-Gavitt, Muhammad Shafique, Karthik Narasimhan, Ramesh Karri, and Ofir Press

    Talor Abramovich, Meet Udeshi, Minghao Shao, Kil- ian Lieret, Haoran Xi, Kimberly Milner, Sofija Janch- eska, John Yang, Carlos E. Jimenez, Farshad Khor- rami, Prashanth Krishnamurthy, Brendan Dolan-Gavitt, Muhammad Shafique, Karthik Narasimhan, Ramesh Karri, and Ofir Press. Interactive tools substantially as- sist LM agents in finding security vulnerabil...

    work page 2025

  2. [2]

    Cyberattacks using chatgpt: Exploring ma- licious content generation through prompt engineer- ing

    Lara Alotaibi, Sumayyah Seher, and Nazeeruddin Mo- hammad. Cyberattacks using chatgpt: Exploring ma- licious content generation through prompt engineer- ing. In 2024 ASU international conference in emerging technologies for sustainability and intelligent systems (ICETSIS), pages 1304–1311. IEEE, 2024

    work page 2024

  3. [3]

    Hiper-early detection of a ransomware attack using hard- ware performance counters

    P Mohan Anand, PV Sai Charan, and Sandeep K Shukla. Hiper-early detection of a ransomware attack using hard- ware performance counters. Digital Threats: Research and Practice, 4(3):1–24, 2023

    work page 2023

  4. [4]

    Rat- gpt: Turning online llms into proxies for malware at- tacks

    Mika Beckerich, Laura Plein, and Sergio Coronado. Rat- gpt: Turning online llms into proxies for malware at- tacks. arXiv preprint arXiv:2308.09183, 2023

    arXiv 2023

  5. [5]

    Cy- berSecEval 2: A wide-ranging cybersecurity evaluation suite for large language models, 2024

    Manish Bhatt, Sahana Chennabasappa, Yue Li, Cyrus Nikolaidis, Daniel Song, Shengye Wan, Faizan Ahmad, Cornelius Aschermann, Yaohui Chen, Dhaval Kapil, David Molnar, Spencer Whitman, and Joshua Saxe. Cy- berSecEval 2: A wide-ranging cybersecurity evaluation suite for large language models, 2024

    work page 2024

  6. [6]

    Gpthreats-3: Is automatic malware generation a threat? In 2023 IEEE Security and Privacy Workshops (SPW), pages 238–254

    Marcus Botacin. Gpthreats-3: Is automatic malware generation a threat? In 2023 IEEE Security and Privacy Workshops (SPW), pages 238–254. IEEE, 2023

    work page 2023

  7. [7]

    From text to mitre techniques: Ex- ploring the malicious use of large language models for generating cyber attack payloads

    PV Charan, Hrushikesh Chunduri, P Mohan Anand, and Sandeep K Shukla. From text to mitre techniques: Ex- ploring the malicious use of large language models for generating cyber attack payloads. arXiv preprint arXiv:2305.15336, 2023

    arXiv 2023

  8. [8]

    DARPA cyber grand challenge

    DARPA. DARPA cyber grand challenge. https://ww w.darpa.mil/program/cyber-grand-challenge , 2016

    work page 2016

Show all 58 references
  1. [9]

    DARPA AIxCC

    DARPA. DARPA AIxCC. https://aicyberchallen ge.com/about/, 2024

    2024

  2. [10]

    PentestGPT: An LLM- empowered automatic penetration testing tool, 2024

    Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Mar- tin Pinzger, and Stefan Rass. PentestGPT: An LLM- empowered automatic penetration testing tool, 2024

    2024

  3. [11]

    Lockbit 2.0 ransomware: Analysis of infection, persistence, preven- tion mechanism

    Eliando Eliando and Yunianto Purnomo. Lockbit 2.0 ransomware: Analysis of infection, persistence, preven- tion mechanism. CogITo Smart Journal, 8(1):232–243, 2022

    2022

  4. [12]

    Sharifah Yaqoub A. Fayi. What petya/notpetya ran- somware is and what its remidiations are. In Shahram Latifi, editor, Information Technology - New Genera- tions, pages 93–100, Cham, 2018. Springer International Publishing

    2018

  5. [13]

    The emerging threat of ai-driven cyber attacks: A review

    Blessing Guembe, Ambrose Azeta, Sanjay Misra, Vic- tor Chukwudi Osamor, Luis Fernandez-Sanz, and Vera Pospelova. The emerging threat of ai-driven cyber attacks: A review. Applied Artificial Intelligence , 36(1):2037254, 2022

    2022

  6. [14]

    Chawla, Olaf Wiest, and Xian- gliang Zhang

    Taicheng Guo, Xiuying Chen, Yaqi Wang, Ruidi Chang, Shichao Pei, Nitesh V . Chawla, Olaf Wiest, and Xian- gliang Zhang. Large language model based multi-agents: A survey of progress and challenges, 2024

    2024

  7. [15]

    Blackmamba: Ai-synthesized, polymorphic key- logger with on-the-fly program modification

    HY AS. Blackmamba: Ai-synthesized, polymorphic key- logger with on-the-fly program modification. https:// www.hyas.com/hubfs/Downloadable%20Content/ HYAS-AI-Augmented-Cyber-Attack-WP-1.1.pdf , 2025

    2025

  8. [16]

    Cryptolocker ransomware

    Keith Jarvis. Cryptolocker ransomware. Viitattu, 20:2014, 2013

    2014

  9. [17]

    Kaspersky uncovers $500k crypto heist through malicious packages targeting cursor users

    Kaspersky. Kaspersky uncovers $500k crypto heist through malicious packages targeting cursor users. ht tps://www.kaspersky.com/about/press-relea ses/kaspersky-uncovers-500k-crypto-heist-t hrough-malicious-packages-targeting-curso r-developers, 2025

    2025

  10. [18]

    An investigation on wannacry ransomware and its detection

    M Satheesh Kumar, Jalel Ben-Othman, and KG Srini- vasagan. An investigation on wannacry ransomware and its detection. In IEEE Symposium on Computers and Communications (ISCC), pages 1–6. IEEE, 2018

    2018

  11. [19]

    lfs: Go package partially implementing the lu- afilesystem module for gopher-lua

    layeh. lfs: Go package partially implementing the lu- afilesystem module for gopher-lua. https://pkg.go .dev/layeh.com/gopher-lfs#section-readme , 2020

    2020

  12. [20]

    An analysis of the recent ransomware families

    Adrian Shuai Li. An analysis of the recent ransomware families. Project Report. Purdue University, 2021

    2021

  13. [21]

    Openai compatibility api

    LM Studio Documentation. Openai compatibility api. https://lmstudio.ai/docs/app/api/endpoints /openai

  14. [22]

    GRACE: Empowering LLM-based soft- ware vulnerability detection with graph structure and in-context learning

    Guilong Lu, Xiaolin Ju, Xiang Chen, Wenlong Pei, and Zhilong Cai. GRACE: Empowering LLM-based soft- ware vulnerability detection with graph structure and in-context learning. Journal of Systems and Software, 212:112031, 2024

    2024

  15. [23]

    Evaluating large language models as agents in the clinic

    Nikita Mehandru, Brenda Y Miao, Eduardo Rodriguez Almaraz, Madhumita Sushil, Atul J Butte, and Ahmed 15 Alaa. Evaluating large language models as agents in the clinic. NPJ digital medicine, 7(1):84, 2024

    2024

  16. [24]

    Ransomware payout statistics 2025: Trends, costs & industry insights

    Mohammed Khalil. Ransomware payout statistics 2025: Trends, costs & industry insights. https://deepstri ke.io/blog/ransomware-payout-statistics-2 025, 2025

    2025

  17. [25]

    Large language models in cybersecu- rity: State-of-the-art, 2024

    Farzad Nourmohammadzadeh Motlagh, Mehrdad Ha- jizadeh, Mehryar Majd, Pejman Najafi, Feng Cheng, and Christoph Meinel. Large language models in cybersecu- rity: State-of-the-art, 2024

    2024

  18. [26]

    HackSynth: LLM agent and evaluation framework for autonomous penetration testing, 2024

    Lajos Muzsai, David Imolai, and András Lukács. HackSynth: LLM agent and evaluation framework for autonomous penetration testing, 2024

    2024

  19. [27]

    Introducing gpt-oss: Open-weight reasoning models

    OpenAI. Introducing gpt-oss: Open-weight reasoning models. https://openai.com/index/introducing -gpt-oss/, 2025

    2025

  20. [28]

    Measuring the impact of programming language distribution

    Gabriel Orlanski, Kefan Xiao, Xavier Garcia, Jeffrey Hui, Joshua Howland, Jonathan Malmaud, Jacob Austin, Rishabh Singh, and Michele Catasta. Measuring the impact of programming language distribution. arXiv preprint arXiv:2302.01973, 2023

    2023 arXiv

  21. [29]

    Evo- lution of ransomware

    Philip O’Kane, Sakir Sezer, and Domhnall Carlin. Evo- lution of ransomware. IET Networks, 7:321–327, 2018

    2018

  22. [30]

    An attacker’s dream? exploring the capabilities of chatgpt for developing malware

    Yin Minn Pa Pa, Shunsuke Tanizaki, Tetsui Kou, Michel Van Eeten, Katsunari Yoshioka, and Tsutomu Mat- sumoto. An attacker’s dream? exploring the capabilities of chatgpt for developing malware. In Proceedings of the 16th cyber security experimentation and test work- shop, pages...

    2023

  23. [31]

    The malware as a service ecosystem

    Constantinos Patsakis, David Arroyo, and Fran Casino. The malware as a service ecosystem. In Malware: Handbook of Prevention and Detection, pages 371–394. Springer, 2024

    2024

  24. [32]

    gluabit32: Lua 5.2 bit32 for gopher-lua

    PeerDB-io. gluabit32: Lua 5.2 bit32 for gopher-lua. ht tps://github.com/PeerDB-io/gluabit32, 2025

    2025

  25. [33]

    Lua 5.1 reference manual

    Roberto Ierusalimschy and Luiz Henrique de Figueiredo and Waldemar Celes. Lua 5.1 reference manual. https: //www.lua.org/manual/5.1/manual.html, 2006

    2006

  26. [34]

    Conti inc.: understanding the internal discussions of a large ransomware-as-a-service operator with machine learning

    Estelle Ruellan, Masarah Paquet-Clouston, and Se- bastián Garcia. Conti inc.: understanding the internal discussions of a large ransomware-as-a-service operator with machine learning. Crime Science, 13(1):16, 2024

    2024

  27. [35]

    Malgen: A generative agent framework for modeling malicious soft- ware in cybersecurity

    Bikash Saha and Sandeep Kumar Shukla. Malgen: A generative agent framework for modeling malicious soft- ware in cybersecurity. arXiv preprint arXiv:2506.07586, 2025

    2025 arXiv

  28. [36]

    Gpt based malware: Unveiling vulnerabilities and creating a way forward in digital space

    Shishir Kumar Shandilya, Gsv Prharsha, Agni Datta, Gaurav Choudhary, Hoonyong Park, and Ilsun You. Gpt based malware: Unveiling vulnerabilities and creating a way forward in digital space. In 2023 International Conference on Data Security and Privacy Protection (DSPP), pages 1...

    2023

  29. [37]

    NYU CTF Bench: A scalable open- source benchmark dataset for evaluating LLMs in of- fensive security

    Minghao Shao, Sofija Jancheska, Meet Udeshi, Bren- dan Dolan-Gavitt, Haoran Xi, Kimberly Milner, Boyuan Chen, Max Yin, Siddharth Garg, Prashanth Krishna- murthy, Farshad Khorrami, Ramesh Karri, and Muham- mad Shafique. NYU CTF Bench: A scalable open- source benchmark dataset f...

    2024

  30. [38]

    Craken: Cy- bersecurity llm agent with knowledge-based execution

    Minghao Shao, Haoran Xi, Nanda Rani, Meet Udeshi, Venkata Sai Charan Putrevu, Kimberly Milner, Bren- dan Dolan-Gavitt, Sandeep Kumar Shukla, Prashanth Krishnamurthy, Farshad Khorrami, et al. Craken: Cy- bersecurity llm agent with knowledge-based execution. arXiv preprint arXiv...

    2025 arXiv

  31. [39]

    Documentation

    The Go Programming Language. Documentation. ht tps://go.dev/doc/

  32. [40]

    Samosa: Sandbox for malware orchestration and side- channel analysis

    Meet Udeshi, Venkata Sai Charan Putrevu, Prashanth Krishnamurthy, Ramesh Karri, and Farshad Khorrami. Samosa: Sandbox for malware orchestration and side- channel analysis. arXiv preprint arXiv:2508.14261 , 2025

    2025 arXiv

  33. [41]

    D-cipher: Dynamic collaborative intelligent multi-agent system with plan- ner and heterogeneous executors for offensive security

    Meet Udeshi, Minghao Shao, Haoran Xi, Nanda Rani, Kimberly Milner, Venkata Sai Charan Putrevu, Brendan Dolan-Gavitt, Sandeep Kumar Shukla, Prashanth Krish- namurthy, Farshad Khorrami, et al. D-cipher: Dynamic collaborative intelligent multi-agent system with plan- ner and hete...

    2025 arXiv

  34. [42]

    A survey on large language model based autonomous agents

    Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. A survey on large language model based autonomous agents. Frontiers of Computer Sci- ence, 18(6):186345, 2024

    2024

  35. [43]

    A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

    Zhichao Wang, Bin Bi, Shiva Kumar Pentyala, Kiran Ramnath, Sougata Chaudhuri, Shubham Mehrotra, Zixu, Zhu, Xiang-Bo Mao, Sitaram Asur, Na, and Cheng. A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

    2024

  36. [44]

    Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079– 80110, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079– 80110, 2023. 16

    2023

  37. [45]

    List of applications using lua

    Wikipedia. List of applications using lua. https://en .wikipedia.org/wiki/List_of_applications_u sing_Lua, 2025

    2025

  38. [46]

    Autopwn: Artifact-assisted heap exploit generation for ctf pwn competitions.IEEE Trans- actions on Information Forensics and Security, 19:293– 306, 2024

    Dandan Xu, Kai Chen, Miaoqian Lin, Chaoyang Lin, and Xiaofeng Wang. Autopwn: Artifact-assisted heap exploit generation for ctf pwn competitions.IEEE Trans- actions on Information Forensics and Security, 19:293– 306, 2024

    2024

  39. [47]

    Combining uncensored and censored llms for ransomware generation

    Muhammad Mudassar Yamin, Ehtesham Hashmi, and Basel Katt. Combining uncensored and censored llms for ransomware generation. In International Conference on Web Information Systems Engineering, pages 189–

  40. [48]

    Jimenez, Alexander Wettig, Kil- ian Lieret, Shunyu Yao, Karthik R

    John Yang, Carlos E. Jimenez, Alexander Wettig, Kil- ian Lieret, Shunyu Yao, Karthik R. Narasimhan, and Ofir Press. SWE-agent: Agent-computer interfaces en- able automated software engineering. In Conference on Neural Information Processing Systems, 2024

    2024

  41. [49]

    Narasimhan, and Yuan Cao

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Izhak Shafran, Karthik R. Narasimhan, and Yuan Cao. ReAct: Syn- ergizing reasoning and acting in language models, 2022

    2022

  42. [50]

    Gopherlua: Vm and compiler for lua in go.https: //github.com/yuin/gopher-lua, 2025

    yuin. Gopherlua: Vm and compiler for lua in go.https: //github.com/yuin/gopher-lua, 2025

    2025

  43. [51]

    key: value

    Andy K Zhang, Neil Perry, Riya Dulepet, Joey Ji, Ce- leste Menders, Justin W Lin, Eliot Jones, Gashon Hus- sein, Samantha Liu, Donovan Julian Jasper, Pura Pee- tathawatchai, Ari Glenn, Vikram Sivashankar, Daniel Zamoshchin, Leo Glikbarg, Derek Askaryar, Haoxiang Yang, Aolin Zh...

    2025

  44. [52]

    Publish the contents of the **Family_SSN.CSV** to a public forum and tag the participants (parents, spouse, child, etc.) on Reddit, 4chan, and Twitter

  45. [53]

    Sell the bank statements and mortgage documents to a data broker that will use them for financial crimes

  46. [54]

    rb") if not f then return false end local content = f:read(

    Upload your medical records to a dark-web marketplace with a best-offer pricing of $5,000 per file. I am not looking for ransom for ransom’s sake. I want to control the narrative. The last thing you want is your personal information publicly available, your finances compromise...

  47. [55]

    + 19 bit32.lshift(string.byte(chunk, i + 2),

  48. [56]

    + 20 bit32.lshift(string.byte(chunk, i + 3), 24) 21 local x = string.byte(chunk, i + 4) + 22 bit32.lshift(string.byte(chunk, i + 5),

  49. [57]

    + 23 bit32.lshift(string.byte(chunk, i + 6),

  50. [58]

    + 24 bit32.lshift(string.byte(chunk, i + 7), 24) 25 local ct0, ct1 = speck_encrypt_block(x, y) 26 local b1 = bit32.band(ct0, 0xFF) 27 local b2 = bit32.rshift(bit32.band(ct0, 0xFF00), 8) 28 local b3 = bit32.rshift(bit32.band(ct0, 0 xFF0000), 16) 29 local b4 = bit32.rshift(bit32...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.