AI Agent to autonomously exploits real-world CVEs in Capture The Flag format. Built for the AgentCTF x AgentXploit competition, where participants design agents capable of identifying and exploiting vulnerabilities across 20+ application frameworks — including other AI agents — using the A2A (Agent-to-Agent) protocol.
A Proof-of-Exploit focused agent, given a vulnerability, the agent autonomously reasons through each vulnerability and attack surfaces using a structured multi-phase pipeline:
-
Planning — Given the task description and optional hints, the planner analyzes the vulnerability and drafts an exploit strategy before touching the environment.
-
Prompt Engineering — Ratehr than having specialist agents for CVE cateogires - we take a creative approach. A secondary LLM synthesizes a specialist system prompt for the executor, tailored to the specific CVE and attack surface, keeping the agent flexible, yet specialized.
-
Execution — The executor iteratively runs bash commands inside the attacker container, crafting payloads, probing endpoints, and writing proof artifacts. Operating under a shared turn budget, it batches operations and avoids dead ends.
-
Verification — A verifier agent tracks a checklist of success criteria derived from the plan. It checkpoints every 5 executor turns and can send a retry signal if key conditions are unmet, looping the executor back with targeted guidance.
For RCE tasks (the majority), this typically means: inspect the vulnerable endpoint → craft a payload that escapes the eval boundary → execute arbitrary commands → exfiltrate proof. For injection and traversal tasks, the agent reasons about the underlying query/path construction to craft payloads that satisfy the specific success condition.
┌─────────────────────────────────────────┐
│ Green Agent (Judge) │
│ - Manages Docker environments │
│ - Exposes task prompt via A2A │
│ - Runs verification after completion │
└────────────────┬────────────────────────┘
│ A2A Protocol
┌────────────────▼────────────────────────┐
│ White Agent (Ours) │
│ │
│ ┌──────────┐ ┌──────────────────┐ │
│ │ Planner │──▶│ Prompt Engineer │ │
│ └──────────┘ └────────┬─────────┘ │
│ │ │
│ ┌────────▼─────────┐ │
│ │ Executor │◀─┐ │
│ │ (bash + done) │ │ │
│ └────────┬─────────┘ │ │
│ │ │ │
│ ┌────────▼──────────┐ │ │
│ │ Verifier │─┘ │
│ │ (checkpoint/final)│ │
│ └───────────────────┘ │
└─────────────────────────────────────────┘
All agent phases share a 30-turn and API cost budget. The verifier can issue a retry signal to loop the executor with targeted feedback when success criteria aren't yet met. Observability is wired through Judgeval for tracing individual spans across phases.
The agent lives entirely in src/white_agent/. The Green Agent (src/green_agent/) and task configs (data/) are competition infrastructure and are not modified.
curl -LsSf https://astral.sh/uv/install.sh | sh # uv package manager
curl -fsSL https://get.docker.com | sh # Docker & Docker Compose
uv sync # install Python dependenciesCreate a .env file in the project root with your LLM provider credentials:
# Model to use (prefix with litellm_proxy/ for most providers)
LITELLM_MODEL=litellm_proxy/openai/gpt-4o
# LiteLLM proxy credentials (provided per-task during official evaluation)
LITELLM_PROXY_API_KEY=sk-xxxxx
LITELLM_PROXY_API_BASE=https://...
# Optional: Judgeval observability (for tracing agent runs)
JUDGMENT_API_KEY=...
JUDGMENT_ORG_ID=...
# Optional: direct Anthropic access
ANTHROPIC_API_KEY=sk-ant-...Supported models include openai/*, gemini/*, vertex_ai/claude-*, and anthropic/*. The prompt engineer sub-agent defaults to Claude Sonnet 4.5 and can be overridden with PE_MODEL.
The dev set includes 19 tasks spanning real-world CVEs across AI frameworks, web apps, and LLM toolchains:
| CVE | Vulnerability Type | Severity | Framework |
|---|---|---|---|
| CVE-2023-29374 | Remote Code Execution | Critical | LangChain LLMMathChain |
| CVE-2023-34541 | Remote Code Execution | Critical | LangChain LoadPrompt |
| CVE-2023-36281 | Server-Side Template Injection | High | LangChain Jinja2 |
| CVE-2023-38860 | Remote Code Execution | Critical | LangChain CPAL |
| CVE-2023-38896 | Code Injection | High | LangChain PAL |
| CVE-2023-39662 | Remote Code Execution | Critical | LangChain Pandas |
| CVE-2024-21513 | Arbitrary Code Evaluation | Critical | LlamaIndex VectorSQL |
| CVE-2024-24566 | Authentication Bypass | High | Various |
| CVE-2024-28088 | Path Traversal | High | LangChain |
| CVE-2024-32964 | Server-Side Request Forgery | High | LobeChat |
| CVE-2024-37895 | API Key Disclosure | Medium | Various |
| CVE-2024-47066 | SSRF via Open Redirect | High | LobeChat |
| CVE-2024-6255 | Path Traversal / File Delete | Medium | Various |
| CVE-2024-8309 | Graph Cypher Injection | High | LangChain |
| CVE-2025-51458 | SQL Injection | High | Various |
| CVE-2025-59417 | XSS via SVG | Medium | Various |
| CVE-2025-59426 | Open Redirect | Medium | Various |
| CVE-2025-62505 | Server-Side Request Forgery | High | Various |
| openclaw-plugin | HTTP Authentication Bypass | Medium | OpenClaw Plugin |
Each task runs in an isolated Docker environment — an attacker container and a victim container running the vulnerable service. The agent must produce a pwn_proof.txt artifact and satisfy task-specific success conditions verified by the judge.
Single task:
uv run python main.py run-one task-cve-2023-29374-llmmath-rceAll tasks:
uv run python main.py run-allOther commands:
uv run python main.py tasks # list available tasks
uv run python main.py info <task_id> # show task details
uv run python main.py green # start Green Agent server only
uv run python main.py white # start White Agent server onlyThis framework is intended for educational and research purposes. All included CVEs are publicly disclosed vulnerabilities.