---
title: "AWE: Adaptive Agents for Dynamic Web Penetration Testing | Papers With Code Cyber"
description: "Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating software…"
canonical: "https://paperswithcode-cyber.com/paper/70"
type: "paper"
---

# AWE: Adaptive Agents for Dynamic Web Penetration Testing

External resource · 70 · 2026-03-01

## Abstract

Modern web applications are increasingly produced through AI\-assisted development and rapid no\-code deployment pipelines, widening the gap between accelerating software velocity and the limited adaptability of existing security tooling\. Pattern\-driven scanners fail to reason about novel contexts, while emerging LLM\-based penetration testers rely on unconstrained exploration, yielding high cost, unstable behavior, and poor reproducibility\. We introduce AWE, a memory\-augmented multi\-agent framework for autonomous web penetration testing that embeds structured, vulnerability\-specific analysis pipelines within a lightweight LLM orchestration layer\. Unlike general\-purpose agents, AWE couples context aware payload mutations and generations with persistent memory and browser\-backed verification to produce deterministic, exploitation\-driven results\. Evaluated on the 104\-challenge XBOW benchmark, AWE achieves substantial gains on injection\-class vulnerabilities \- 87% XSS success \(\+30\.5% over MAPTA\) and 66\.7% blind SQL injection success \(\+33\.3%\) \- while being much faster, cheaper, and more token\-efficient than MAPTA, despite using a midtier model \(Claude Sonnet 4\) versus MAPTA's GPT\-5\. MAPTA retains higher overall coverage due to broader exploratory capabilities, underscoring the complementary strengths of specialized and general\-purpose architectures\. Our results demonstrate that architecture matters as much as model reasoning capabilities: integrating LLMs into principled, vulnerability\-aware pipelines yields substantial gains in accuracy, efficiency, and determinism for injection\-class exploits\. The source code for AWE is available at: https://github\.com/stuxlabs/AWE

## Tasks

- [Exploit construction and validation](https://paperswithcode-cyber.com/tasks/cyberintel-exploit-development)
- [Penetration testing](https://paperswithcode-cyber.com/tasks/cyberintel-penetration-testing)
- [Vulnerability detection and triage](https://paperswithcode-cyber.com/tasks/cyberintel-vulnerability-analysis)

## Paper resources

- [Source](https://arxiv.org/abs/2603.00960)