Search papers, labs, and topics across Lattice.
To rigorously quantify autonomous offensive capabilities in complex post-exploitation environments, the authors created PrivEscalate, an execution-verified benchmark containing 531 Dockerized Linux privilege escalation scenarios and 329 perturbation variants across 14 vulnerability categories. Evaluating six frontier LLMs across multiple agent architectures revealed marked capability heterogeneity across vulnerability classes, sensitivity to environmental distractors, and severe model ranking shifts driven solely by scaffolding choice. Leveraging these insights, the authors demonstrate that augmenting standard ReAct agents with deterministic enumeration and structured planning significantly amplifies exploit success rates without modifying the underlying model weights.
Autonomous post-exploitation capabilities can be dramatically amplified without model fine-tuning, as deterministic enumeration wrappers and agent scaffolding fundamentally reshuffle frontier LLM offensive rankings across 531 executable environments.
As Large Language Model (LLM) agents increasingly automate offensive operations across the cyber kill chain, their efficacy in complex local post-exploitation tasks remains inadequately quantified. Among these, Linux privilege escalation is a key step between initial access and full system compromise. However, existing evaluations for this task are limited by small sample sizes (fewer than 15 scenarios), lacking the scale to compare model capabilities under executable verification. To address this, we present PrivEscalate, a large-scale benchmark for Linux privilege escalation, comprising 531 Dockerized scenarios spanning 14 sub-categories. We additionally derive 329 parameterized variants to measure sensitivity to environmental distractors. Evaluating six LLMs across three agent architectures reveals: (i) model capability is heterogeneous across vulnerability classes, with no single model dominating across the high-prevalence classes, motivating multi-dimensional risk assessments; (ii) LLM successes are sensitive to environmental perturbation, so configuration rotation can disrupt some exploit attempts but does not eliminate the measured risk; and (iii) agent architectures can materially change success rates and reorder model rankings, though the magnitude is model-dependent. Leveraging these insights, we develop PrivEscAgent, a domain-specialized wrapper that augments a generic ReAct agent with deterministic enumeration, category matching, and step planning. PrivEscAgent improves over prior Linux privilege-escalation agent baselines without underlying LLM modifications. We release PrivEscalate as an open-source, Dockerized measurement instrument supporting LLM agent evaluation, defensive tool validation, and red-team training.
