ZERO-APT: New LLM framework beats AI defenses with 79% attack success rate

ZERO-APT is a new closed-loop adversarial framework that brings realism, consistency, and auditability to LLM-driven automated penetration testing. Unlike previous approaches that evaluate agents against static targets, ZERO-APT includes a turn-based architecture with three roles: an Attacker, a Defender, and a Judge. The Defender is a configurable LLM that consumes Sysmon telemetry to detect attacks in real time, forcing the Attacker to adapt to a live opponent rather than a passive target. To maintain causal consistency of multi-step attack chains, the framework separates planning from execution, uses multi-dimensional ReAct feedback, and enforces a hard-constraint-filtered action library. This moves consistency from unstable LLM reasoning into enforced system architecture. A dedicated Judge agent adjudicates each round, maintains global state, and produces structured post-hoc CTI reports that make every decision traceable.

The researchers evaluated a Windows Server 2022 post-exploitation prototype across five scenarios with three Defender configurations. ZERO-APT achieved a 79% attack success rate, dramatically outperforming baseline agents Aurora (22%) and PentestGPT (39%). The causal consistency score reached 0.860, compared to 0.930 for Aurora and 0.520 for Claude Code. End-to-end decision auditability is provided through structured CTI reports. The authors have released the benchmark to support future evaluation of penetration agents under intelligent defense, marking a significant step toward more realistic and trustworthy automated red teaming.