AI Agents Automate IoT Hacking: VEXAIoT Achieves 95% Success Rate

Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, Maanak Gupta · July 10, 2026

Researchers have developed VEXAIoT, an autonomous multi-agent framework that uses large language models (LLMs) to find and exploit vulnerabilities in IoT devices. The system consists of two AI agents: one that detects vulnerabilities and another that executes attacks. Tested on IoTGoat and Metasploitable environments across 10 attack scenarios mapped to OWASP IoT vulnerabilities, VEXAIoT achieved a 95% overall success rate in 260 attack executions, with most attacks completed in under two minutes and low token usage. This demonstrates that LLM-driven agents can automate IoT security testing effectively, potentially reducing the time and expertise needed for penetration testing. However, the research was conducted in controlled environments, so real-world effectiveness may vary. The approach could lead to more scalable and adaptive security assessments for the rapidly growing IoT ecosystem, helping organizations identify and fix vulnerabilities before malicious hackers exploit them.