Where LLM Cyber Agents Break: Bottlenecks in Multi-Stage Runs
Ask a red-teamer why their scripted attack chain works but their LLM-driven one stalls, and the answer is rarely "the model isn't smart enough".
Where LLM Cyber Agents Break: Bottlenecks in Multi-Stage Runs
Ask a red-teamer why their scripted attack chain works but their LLM-driven one stalls, and the answer is rarely “the model isn’t smart enough”. It’s the orchestrator handing the executor a tool that doesn’t fit, or a validator that shrugs “looks good” at an empty shell response. A new diagnostic study of multi-stage cyber agents (arXiv 2609.28572) tears open six frontier models across three autonomy modes and puts numbers on the failure modes we’ve been guessing at.
What the study measured, and why it hurts
The authors ran orchestrator-executor-validator agents through enterprise lateral-movement scenarios — the same tactic family catalogued in MITRE ATT&CK TA0008 — and graded not just “did the agent pop the box” but cost per attempt, evidence interpretation quality, and adaptation after failure. An LLM-as-a-Judge overlay caught cases where the agent claimed success on output that a human analyst would flag as a broken command.
Three bottlenecks dominate. Tool misalignment: the orchestrator picks smbclient when the target speaks WinRM. Weak recovery: after one failed hop, the executor loops on the same broken invocation instead of switching credentials. Optimistic validators: the judge rubber-stamps a 502 as “authentication succeeded”. Anyone who has built agentic pipelines for AEGIS engagements will recognize the pattern.
2026-09-24T09:14:02Z orch: selected tool=impacket-psexec target=10.42.7.19
2026-09-24T09:14:03Z exec: run -> "SMB SessionError: STATUS_LOGON_FAILURE"
2026-09-24T09:14:04Z valid: verdict=success, note="host reachable"
2026-09-24T09:14:05Z orch: proceed to stage=credential_dump
2026-09-24T09:14:06Z exec: run -> "target unreachable, session invalid"That validator line is the killer. The chain moves on because the judge conflated “TCP reachable” with “authenticated”. Every subsequent stage burns tokens against a dead context.
The architecture pattern that survives
Two design moves cut the failure rate in our internal runs. First, the validator schema is written per-tool, not per-stage — impacket-psexec success means a RemoteShell object, not a 200-style boolean. Second, cost-aware routing kicks a stuck plan back to the orchestrator after N failed attempts rather than letting the executor spin. The ENISA Threat Landscape 2024 flags the same issue from the defender’s side: agents that hallucinate progress are indistinguishable from adversaries who pivot silently.
Why this matters for NIS2-scope operators
Under Directive (EU) 2022/2555, incident-detection expectations tighten and defensive tooling built on LLM agents is entering procurement pipelines. NIST’s AI Risk Management Framework GenAI Profile lists over-trusted evaluation as a category-one risk. If the validator lies, the SOC ticket lies, and the audit trail lies with it.
CAI Technology’s position: success rate is a vanity metric. We instrument every agent step with a per-tool evidence schema and a cost ceiling, and we treat validator disagreements as first-class signals fed to our IRIS multi-agent observability stack. If you’re evaluating an agentic red-team platform this quarter, ask the vendor how their validator handles a 502 — and what it costs when it’s wrong.