---
title: "Cochise: A Reference Harness for Autonomous Penetration Testing (arXiv:2605.11671) | Papers With Code Cyber"
description: "Recent work on LLM-driven autonomous penetration testing reports promising results, but existing systems often bundle architectural, prompting, and tool-integration choices…"
canonical: "https://paperswithcode-cyber.com/paper/2605.11671"
type: "paper"
---

# Cochise: A Reference Harness for Autonomous Penetration Testing

arXiv:2605\.11671 · 2026-05-12

Authors: Happe, Andreas, Cito, Jürgen

## Abstract

Recent work on LLM\-driven autonomous penetration testing reports promising results, but existing systems often bundle architectural, prompting, and tool\-integration choices together\. This makes it difficult to determine what is gained over a simple agent and harness\. We present Cochise, a 630 LOC Python reference implementation for autonomous penetration\-testing experiments\. Cochise connects to a Linux execution host over SSH and supports attacking controlled target environments reachable from that jump host\. The prototype implements a Planner\-\-Executor architecture in which long\-term state is maintained by the planner, while a ReAct\-style executor issues commands over SSH and self\-corrects based on command outputs\. The scenario prompt can be adapted to different target environments\. We evaluate the harness against a live third\-party testbed, Game of Active Directory \(GOAD\)\. Cochise is intended not as a state\-of\-the\-art penetration\-testing agent, but as a reusable experimental infrastructure for comparing models, agent architectures, and penetration\-testing traces\. Alongside the prototype, we release replay and analysis tools: \(i\) cochise\-replay for offline visualization of captured runs, \(ii\) cochise\-analyze\-logs and cochise\-analyze\-graphs for cost, token, duration, and compromise analysis, and \(iii\) a corpus of JSON trajectory logs from GOAD runs, so that researchers can study agent behavior without provisioning the 48\-\-64 GB RAM / 190 GB storage testbed themselves\. Tool demo video available at https://youtu\.be/2mQimB1ufyI\.

## Tasks

- [Penetration testing](https://paperswithcode-cyber.com/tasks/cyberintel-penetration-testing)

## Code repositories

- [andreashappe/cochise](https://github.com/andreashappe/cochise)

## Paper resources

- [Abstract page](https://arxiv.org/abs/2605.11671v2)
- [PDF](https://arxiv.org/pdf/2605.11671v2.pdf)