Thesis: Hack Yourself First: Autonomous LLM Agents for Continuous Penetration Testing

High Level Description

Insecure systems are everywhere. What matters is who finds the exploit first. Internal networks, such as an office LAN, are often

assumed to be secure, but a single rogue or insecure IoT device, such as a smart TV, can give an attacker a way in. Penetration

testing means trying to break into your own systems, with permission, to find security issues before an attacker does. It needs

skilled people, so it is often done only now and then, while the systems keep changing.

Large Language Model (LLM) agents can now use tools and solve tasks in several steps. They are starting to be used for attacks,

but how useful they are for defence is not yet well studied.

This thesis will investigate how an LLM agent can secure a network by acting as an attacker. The agent finds issues, investigates

them and sends a report to the person responsible for the security posture.

Project Description

This thesis aims to evaluate LLM penetration testing as a way to continuously secure networks and environments.

An LLM agent will run from a jump host inside a test environment with known vulnerabilities. The agent does the whole process by

itself. It performs reconnaissance such as port scanning, finds vulnerabilities, tries to exploit them and sends a report. The

reports are compared with the known vulnerabilities, and the actions of the agent are checked for anything unsafe.

Security is easy to deprioritise when schedules are busy. Testing continuously instead of now and then means issues can be found

sooner, by the right people rather than by attackers.

Examples of relevant technologies include MCP (Model Context Protocol), Linux and Nmap. Examples of relevant vulnerabilities

include weak or default credentials, poor network segmentation, misconfigurations, and web vulnerabilities from OWASP Top 10.

Purpose

This thesis will investigate the following areas:

1. Automated penetration testing – Investigate how well an LLM agent can do a whole penetration test by itself, from

reconnaissance to exploitation and reporting. Measure how many of the known vulnerabilities it finds and exploits, and how long it

takes.

2. Reliability of findings – Are the reports useful, or full of false positives? Can multi-agent orchestration be used to verify

the reports?

3. Trust in LLM agents – Can agents be trusted in sensitive environments, and what if they break something? A human tester knows

not to cause a denial of service, but an agent might not. Investigate if cloned environments or sandboxing the agent reduce this

risk.

The implementations are proof-of-concept, not finished products, and are meant for experimentation and evaluation. The long-term

goal is that the results can later be developed into a useful solution for businesses.

• The agent accesses the environment from a single jump host, not from several points. It runs through a managed agent CLI, such

as Claude Code or GitHub Copilot CLI, or in a setup we host ourselves.

• Testing is only done on authorised targets, with a defined threat model, such as an attacker inside the local network or from

the outside.

• The study uses existing models. Training our own models is out of scope, and fine-tuning is only considered if there is a clear

reason for it.

An Exciting Journey with Knightec Group

Semcon and Knightec have joined forces as Knightec Group. Together, we are Northern Europe’s leading strategic partner in

product and digital service development. With a unique combination of cross-functional expertise and a holistic business

understanding, we help our clients realize their strategies – from idea to complete solution.

Practical Information

This is a thesis position, located at our office in Sundsvall. Start date January or March 2027.

Please submit your application as soon as possible, but no later than 2026-11-30. If you have any questions, you are welcome to

contact johanna.edstrom@knightec.se. Note that due to GDPR, we only accept applications through our careers page.