Traditional vulnerability assessments and manual penetration testing rely on point-in-time audits. As enterprise systems and virtualized environments grow in complexity, these static evaluations struggle to scale, often leaving security gaps exposed between assessment cycles. To maintain a proactive defensive posture, organizations require continuous, dynamic security testing methodologies.

One approach to solve this problem lies in the development of autonomous penetration testing AI agents. By leveraging Small Language Models (SLMs), these agents can be designed to continuously probe infrastructure and reason through complex attack paths without human intervention. Exploring this automated capability allows defenders to proactively discover and remediate vulnerabilities within enterprise environments before they can be exploited by malicious actors.

The task of the student is to develop a proof-of-concept AI agent capable of autonomously achieving local privilege escalation on an Linux-based virtual machine. All decisions regarding the attack has to be made by a small language model.

Tasks to be performed by the student will include:

- Present the state of the art on using language models, both small and large, for penetration testing and vulnerability assessment
- Design an autonomous AI agent that uses a small language model and that is capable of performing local privilege escalation
- Implement the designed AI agent as a Proof-of-Concept
- Evaluate the implemented AI agent against a vulnerable Linux-based virtual machine