---
title: "PENTESTLLMAGENT: A Task Dependency Graph Planning-Based Multi-Agent Framework for Automated Penetration Testing"
authors:
  - "Shuo Sheng"
  - "Jixin Zhang"
  - "Jia Yang"
  - "Ke Cheng"
  - "Zheng Qin"
doi: "10.24963/ijcai.2026/725"
url: "https://ijcai.org/proceedings/2026/725"
pdf: "https://ijcai.org/proceedings/2026/0725.pdf"
venue: "Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence"
year: 2026
pages: "6518-6527"
track: "AI4Tech: AI Enabling Technologies"
keywords:
  - "Advanced AI4Tech: Generative and LLMs-driven AI4Tech"
  - "Domain-specific AI4Tech: AI4Security"
---

# PENTESTLLMAGENT: A Task Dependency Graph Planning-Based Multi-Agent Framework for Automated Penetration Testing

Shuo Sheng, Jixin Zhang, Jia Yang, Ke Cheng, Zheng Qin

*Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence*, pages 6518-6527. DOI: [10.24963/ijcai.2026/725](https://doi.org/10.24963/ijcai.2026/725)

## Abstract

Fully autonomous IP-to-Root penetration testing remains challenging for LLM agents. We conduct an exploratory study on 10 LLMs and introduce AutoPentest-Bench, an end-to-end benchmark with 13 VulnHub targets and 93 sub-tasks. From 130 interaction logs, we identify three challenges: Rigid Strategy, Contextual Forgetting, and Command Generation Hallucination. To address them, we propose PentestLLMAgent, which integrates a Task Dependency Graph (TDG) for dynamic planning and backtracking; a Hierarchical Multi-Agent Architecture (HMA) with function-calling-based tool invocation, output filtering, and semantic compression, and Executable Knowledge-Guided Command Generation (EKG-CG) for retrieving and executing pre-validated, environment-compatible commands. Evaluations demonstrate strong effectiveness: on end-to-end AutoPentest-Bench, PentestLLMAgent achieves a 77% success rate; on AutoPT’s web exploitation benchmark, it attains a 95% overall pass rate; and on the privilege escalation benchmark, it achieves a 100% success rate. In realistic end-to-end runs, it averages 10.9 minutes, 36 interaction rounds, and 69.6K tokens per target. The code, benchmark, and executable knowledge base are publicly available at https://github.com/sanbai123/PentestLLMAgent_code-and-videos.