APIOT: Autonomous Vulnerability Management Across Bare-Metal Industrial OT Networks

Abstract:Operational technology (OT) devices run safety-critical physical processes, yet their security testing remains manual and expert-intensive. Autonomous security agents could ease this burden, but bare-metal OT devices are difficult targets because they lack shells, filesystems, and named exploit abstractions, requiring operation through protocol fields and observable device state. We present APIOT (Autonomous Purple-teaming for Industrial OT), a large language model (LLM) agent framework that completes a discovery -> exploitation -> network-level mitigation -> verification workflow without human intervention. We evaluate APIOT in 360 runs on vulnerable firmware and simulators for Zephyr RTOS, spanning five LLMs, three topologies, two impairment levels, and prompt, tooling and two ablations. APIOT completed 90% of primary missions (63/70 across protocols and topologies) and 85% of 150 cross-model runs (128/150) - feasible across models, with substantial variation. Named exploit tools (e.g., a canned CoAP option-overflow) were faster, but protocol primitives (the agent builds the fields itself) produced more reusable mitigations that blocked unseen payload variants. Runtime oversight improved reliability: success rose from 27/30 to 29/30 with rule-based guards and 30/30 when a second LLM added advisory steering. To our knowledge, this is the first end-to-end autonomous attack-remediation demonstration on bare-metal industrial devices, establishing controlled feasibility - not zero-day discovery or production-OT transfer.

36 pages, 6 figures. Updated version; submitted to Computers & Security

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

arXiv:2605.02346 [cs.CR]

(or arXiv:2605.02346v2 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2605.02346 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.