A Multi-Agent Large Language Model Framework for Autonomous Web Application Penetration Testing
Year: 2026
Type: preprint
Abstract: As cyberattacks targeting web applications are becoming progressively more sophisticated, traditional penetration testing finds it difficult to keep pace with the evolving and adaptive tactics of modern attackers. Some manual tools are effective for detecting standard vulnerabilities, but they lack semantic reasoning or logical flaws, limiting their ability to discover complex exploit chains. While recent AI-based approaches and Large Language Models (LLMs) show potential for automating vulnerability analysis, most of them still lack integration with practical, real-world testing environments. Furthermore, reinforcement learning has been examined for attack simulation planning, but its integration within operational red-teaming applications is still immature.This study presents ARES (Automated Red-Teaming Evaluation System) --- an AI-driven, multi-agent penetration testing framework built for autonomous, ethical and adaptive vulnerability assessment by integrating the use of Large Language Models (LLMs) and reinforcement learning. ARES is built uponthe open-source Hexstrike-AI, along with two key modules: ARES v1, a domain-specific fine-tuned LLM trained with OWASP and ExploitDB datasets for thorough understanding of exploit reasoning; and ARES-RL, a Proximal Policy Optimization (PPO) based module selection and attack sequencing. Tested on controlled web environments such as DVWA, OWASP Juice Shop, and bWAPP, ARES demonstrated that it could achievehigher vulnerability findings and efficiency than traditional scanners, while enhancing its reasoningand exploit accuracy over practice iterations. ARES represents a novel convergence of LLM-based reasoning, reinforcement learning, and modular automation, advancing the field toward safe, ethicalred-teaming frameworks for web application security.
Source: Research Square
Institution: Parul University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7220921908