Daily Arxiv

This is a page that curates AI-related papers published worldwide.
All content here is summarized using Google Gemini and operated on a non-profit basis.
Copyright for each paper belongs to the authors and their institutions; please make sure to credit the source when sharing.

Multi-Agent Penetration Testing AI for the Web

Created by
  • Haebom

Author

Isaac David, Arthur Gervais

Outline

This paper presents MAPTA, a multi-agent system, to address the scalability crisis in web application security auditing arising from the proliferation of AI-based software development platforms. MAPTA performs autonomous web application security assessments by combining large-scale language models, tool-based execution, and end-to-end exploit verification. It demonstrates excellent performance on the XBOW benchmark (104 tasks), particularly in the detection of SSRF and misconfiguration errors. Cost analysis reveals an average cost of $0.073 for each successful attempt and $0.357 for each failed attempt, demonstrating a strong correlation between success and resource efficiency. Evaluation of real GitHub repositories (8K-70K stars) uncovered serious vulnerabilities, including RCE, command injection, secret disclosure, and arbitrary file writes, with 10 findings under CVE review.

Takeaways, Limitations

Takeaways:
Demonstrating the effectiveness of an AI-based automated web application security assessment system.
Presenting a cost-effective security auditing method.
Discovering and responsibly disclosing critical vulnerabilities in real-world environments.
Presenting the possibility of security auditing using large-scale language models.
Limitations:
Low detection rates for cross-site scripting (57%) and blind SQL injection (0%).
Need to improve detection performance for specific types of vulnerabilities.
👍