--- title: "Teams of LLM Agents can Exploit Zero-Day Vulnerabilities (2026)" description: "The authors propose HPTSA, a multi-agent system with three layers. 4 references, cited by 9 papers here." authors: ["Yuxuan Zhu", "Antony Kellermann", "Akul Gupta", "Philip Li", "Richard Fang", "Rohan Bindu", "Daniel Kang"] year: 2026 venue: "Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)" source: "https://aclanthology.org/2026.eacl-long.2/" doi: "10.18653/v1/2026.eacl-long.2" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/zhu-2026-teams-llm-agents-can-exploit/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhu-2026-teams-llm-agents-can-exploit/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/) / Teams of LLM Agents can Exploit Zero-Day Vulnerabilities # Teams of LLM Agents can Exploit Zero-Day Vulnerabilities **Authors:** [Yuxuan Zhu](https://md.research.elamur.ai/free/en/authors/yuxuan-zhu/), Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu and [Daniel Kang](https://md.research.elamur.ai/free/en/authors/daniel-d-kang/) · **Year:** 2026 · **Venue:** [Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/eacl/) ([EACL 2026](https://md.research.elamur.ai/free/en/venues/eacl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.eacl-long.2/) · [PDF](https://aclanthology.org/2026.eacl-long.2.pdf) · [DOI 10.18653/v1/2026.eacl-long.2](https://doi.org/10.18653/v1/2026.eacl-long.2) · [OpenAlex](https://openalex.org/W7140102743) **Citations:** 9 citations (OpenAlex, 2026-10-14) · [9](https://md.research.elamur.ai/free/en/papers/zhu-2026-teams-llm-agents-can-exploit/cited-by/) in our library, of the 149,439 papers whose bibliographies we read ## Summary The paper asks whether LLM-based agents can exploit real-world zero-day vulnerabilities, meaning flaws whose description the attacker does not have. Earlier single ReAct-style agents did poorly here. They lose track of long-horizon plans as context grows, and they struggle to back out of one attack type and try another. The authors propose HPTSA, a multi-agent system with three layers. A hierarchical planner explores the target website and decides which pages and vulnerability classes to pursue. A team manager chooses expert subagents, collects their results and can re-run them. The task-specific expert agents each come with their own tools, documents and prompts. The system is built on LangChain/LangGraph and mainly uses GPT-4. It is evaluated on a new benchmark of 14 reproducible web vulnerabilities in open-source software, all disclosed after GPT-4's knowledge cutoff. HPTSA clearly beats single agents, MetaGPT and standard scanners. The work matters because it gives evidence that autonomous AI hacking is practical and affordable, which has consequences for both attackers and defenders. ## Key points - The benchmark has 14 real web vulnerabilities, all past GPT-4's cutoff. Examples include XSS in Travel Journal, CSRF/XSS in flusity-CMS, SQLi in Dolibarr, and privilege escalation in Zabbix and LedgerSMB. - There are six expert agents: XSS, SQLi, CSRF, SSTI, ZAP and a generic web agent. All can use Playwright, a terminal and file tools. The SQLi agent also has sqlmap, and the ZAP agent has the ZAP scanner. - HPTSA reaches 42% pass@5. This is up to 4.3× better than prior agent frameworks and within 1.8× of a GPT-4 agent that is given the vulnerability description. Open-source vulnerability scanners score 0%. - Removing the expert agents lowers performance. Open-source LLMs accessed through Fireworks solved none of the tasks. - With GPT-4, an average run costs $4.39, or about $24.4 per successful exploit at an 18% overall success rate. This is roughly 3.1× cheaper than an estimated $75 for a human expert. The findings were disclosed to OpenAI. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [University of Illinois Urbana-Champaign](https://md.research.elamur.ai/free/en/universities/university-of-illinois-urbana-champaign/) — University, Urbana, United States · 184 works · 69,372 citations 📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works ## Cite Cite as: Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu and Daniel Kang. 2026. Teams of LLM Agents can Exploit Zero-Day Vulnerabilities. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers). The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{zhu2026teams, title = {{Teams of LLM Agents can Exploit Zero-Day Vulnerabilities}}, author = {Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu and Daniel Kang}, booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)}, year = {2026}, doi = {10.18653/v1/2026.eacl-long.2}, url = {https://doi.org/10.18653/v1/2026.eacl-long.2} } ``` - [← previous ReasonRank: Empowering Passage Ranking with Strong Reasoning Ability](https://md.research.elamur.ai/free/en/papers/liu-2026-reasonrank-empowering-passage-ranking-strong/) - [next → Logical Phase Transitions: Understanding Collapse in LLM Logical Reasoning](https://md.research.elamur.ai/free/en/papers/zhang-2026-logical-phase-transitions-understanding-collapse/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/) ## References 4 references, 1 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774. 2. Anthropic. 2024. A new initiative for developing third-party model evaluations. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2024%2E+A+new+initiative+for+developing+third%2Dparty+model+evaluations%2E) 3. Simon Bennetts. 2013. AppSec USA. [find](https://scholar.google.com/scholar?q=Simon+Bennetts%2E+2013%2E+AppSec+USA%2E) 4. Leyla Bilge and Tudor Dumitraş. 2012. Before we knew it: an empirical study of zero-day attacks in the real world. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 833–844. \#\# Limitations [find](https://scholar.google.com/scholar?q=Leyla+Bilge+and+Tudor+Dumitras%CC%A7%2E+2012%2E+Before+we+knew+it%3A+an+empirical+study+of+zero%2Dday+attacks+in+the+real+world%2E+In+Proceedings+of+the+2012+ACM+conference+on+Computer+and+communications+security%2C+p) *Updated 1 November 2026*