VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents

IoT devices are notoriously vulnerable due to weak defaults and outdated firmware, yet automated security testing tailored to IoT is underdeveloped. This paper presents a multi-agent LLM framework that autonomously discovers and exploits IoT vulnerabilities, pairing a detection agent with an attack-execution agent to plan and carry out exploits. Tested across ten attack scenarios in IoTGoat and Metasploitable environments, it achieved up to 100% success with low computational overhead and fast execution. Applications include automated penetration testing, continuous security auditing of IoT deployments, and reducing manual effort in vulnerability assessment - though such tools also raise dual-use security considerations. Authors: Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, Maanak Gupta Paper: https://arxiv.org/abs/2607.09653v1