Engineering and Evaluating an Autonomous Agent for Post-Exploitation
AI agents are increasingly demonstrating impressive vulnerability-discovery capabilities. But what happens after a bug is exploited and the agent gets onto the system?
For a human red teamer, post-exploitation is often where the interesting work begins. Initial access provides a foothold, but accomplishing a meaningful objective requires much more: understanding the environment, finding useful credentials, deciding which paths are worth pursuing, validating access, enumerating permissions, and determining whether that access leads to objectives or enables meaningful security impact.
Over the past few years, I've been experimenting with using AI agents to automate portions of offensive security. More recently, I've focused on this post-exploitation problem: can an AI agent take an initial foothold and independently reason its way toward meaningful impact?
The short answer from my testing is yes — but reliable performance requires careful engineering.
When successful, the agent could move from an operator-provided objective to credential discovery and authenticated data access in only a few minutes and for well under a dollar of model inference. The more interesting finding, however, was how heavily that performance depended on the complete agent system: the model, system prompts, tools, orchestration, context, and safeguards.
The model mattered, but the real unit of evaluation was the complete agent system.
